Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An authenticated attacker can obtain any plant name by knowing the plant ID.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can export other users' plant information.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can hijack other users' devices and potentially control them.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename "rooms" of arbitrary users.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can query an API endpoint and get device details.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.

BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can change registered email addresses of other users and take over arbitrary accounts.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger energy consumption information of other users.

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.