CVE-2025-31360 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...

CVE-2025-30512 Growatt Cloud portal External Control of System or Configuration Setting

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...

CVE-2025-30512 Growatt Cloud portal External Control of System or Configuration Setting

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...

CVE-2025-27927 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...

CVE-2025-27927 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...

CVE-2025-24297

CVE-2025-24297 affects Growatt Cloud Portal (Growatt Cloud Applications). Root cause: lack of server-side input validation leading to cross-site scripting. Vulnerable component/function: plant name handling during add/edit operations (stored XSS). Impact: attackers can inject JavaScript into user...

CVE-2025-24297 Growatt Cloud portal Cross-site Scripting

Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal...

CVE-2025-24297 Growatt Cloud portal Cross-site Scripting

Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal...

CVE-2025-30510

Growatt Cloud Applications (version 3.6.0 and earlier) is affected by a vulnerability where an attacker can upload an arbitrary file in place of a plant image. Public sources note this in multiple records (CNNVD, RH/Red Hat CVE, NVD). Some documents also describe related issues involving improper...

CVE-2025-30510 Growatt Cloud portal Insufficient Type Distinction

An attacker can upload an arbitrary file instead of a plant image...

CVE-2025-24850 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can export other users' plant information...

CVE-2025-24850 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can export other users' plant information...

CVE-2025-25276 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can hijack other users' devices and potentially control them...

CVE-2025-25276 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can hijack other users' devices and potentially control them...

CVE-2025-27565 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs...

CVE-2025-27565 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs...

CVE-2025-27565

CVE-2025-27565 affects the Growatt Cloud Applications/Cloud portal. Multiple connected sources confirm an unauthenticated attacker can delete any user’s legitimate data by knowing the user ID and the target room ID, implying an authorization failure in manipulating user-controlled room resources....

CVE-2025-27575 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID...

CVE-2025-27575 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID...

CVE-2025-27575

Consolidated details from connected sources show a vulnerability affecting Growatt Cloud Applications (EV charger management) that allows an unauthenticated attacker to learn the EV charger version and firmware upgrading history by knowing the charger ID. Root cause appears to be information disc...