Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 37

Export CSV
CVE-2025-27561

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename "rooms" of arbitrary users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27565

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27575

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27719

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can query an API endpoint and get device details.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27927

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27929

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30257

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30512

Growatt Cloud portal External Control of System or Configuration Setting

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27938

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27939

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can change registered email addresses of other users and take over arbitrary accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30511

Growatt Cloud Applications Cross-site Scripting

An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30514

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31950

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger energy consumption information of other users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31654

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31360

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27568

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-24487

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can infer the existence of usernames in the system by querying an API.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal