CVE-2025-27938 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections i.e., "rooms"...

CVE-2025-27938

Growatt Cloud Applications (Growatt Cloud portal) suffers an unauthenticated authorization bypass that allows access to restricted user “rooms” information. Public docs indicate this affects versions up to 3.6.0 (and prior) and that no patch version is specified; exploitation status not publicly ...

CVE-2025-27938 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections i.e., "rooms"...

CVE-2025-27938

creationtimestamp| type| source ---|---|--- 2025-04-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04...