166 matches found
CVE-2025-30254
CVE-2025-30254 affects Growatt Cloud Applications (noted in multiple feeds). The CSC-grade description shows an unauthenticated attacker can obtain a meter serial number by querying with a user’s username. CNNVD-202504-2298 specifies vulnerable versions up to 3.6.0 and earlier; other sources reit...
CVE-2025-30254 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a serial number of a smart meters using its owner's username...
CVE-2025-27568 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...
CVE-2025-27568
Growatt Cloud Portal (Growatt Cloud Applications) is affected by CVE-2025-27568, where an unauthenticated attacker can determine a user’s email by knowing the username, causing a password-reset email to be sent. Public documents reference the authorization bypass exposure without detailing a fixe...
CVE-2025-27568 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...
CVE-2025-24487
CVE-2025-24487 concerns Growatt Cloud Applications (Cloud portal). Multiple connected sources indicate an unauthenticated attacker can infer the existence of usernames by querying an API, implying an exposed endpoint that reveals user existence without requiring authentication. Publicly cited ref...
CVE-2025-24487 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can infer the existence of usernames in the system by querying an API...
CVE-2025-24487 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can infer the existence of usernames in the system by querying an API...
CVE-2025-31941
Growatt Cloud Applications (China) is affected by an information-disclosure vulnerability described in multiple sources as CVE-2025-31941. The issue allows an unauthenticated attacker to obtain a list of smart devices by using a valid username, with affected versions up to 3.6.0 and prior (per CN...
CVE-2025-31941 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username...
CVE-2025-31941 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username...
CVE-2025-31357
CVE-2025-31357 affects Growatt Cloud Applications (cloud portal). The connected documents describe an information-disclosure vulnerability where an unauthenticated attacker can obtain a user’s plant list by knowing the username. Evidence of the issue appears across multiple sources (CVE lists, CN...
CVE-2025-31357 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a user's plant list by knowing the username...
CVE-2025-31357 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a user's plant list by knowing the username...
CVE-2025-31949
Growatt Cloud Applications (Growatt Cloud portal) is affected by CVE-2025-31949. An authenticated attacker can obtain arbitrary plant names by supplying a plant ID, indicating an access/validation weakness in the plant-name retrieval mechanism. Public details confirm vulnerable versions include 3...
CVE-2025-31949 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An authenticated attacker can obtain any plant name by knowing the plant ID...
CVE-2025-31949 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An authenticated attacker can obtain any plant name by knowing the plant ID...
CVE-2025-31933 Growatt Cloud Applications Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can check the existence of usernames in the system by querying an API...
CVE-2025-31933
CVE-2025-31933 affects Growatt Cloud Applications. An unauthenticated attacker can enumerate usernames by querying an API; CNNVD cites affected versions 3.6.0 and earlier. The issue originates from unauthenticated access to a username list via the API. Red Hat and NVD entries corroborate the basi...