Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30

Export CSV
CVE-2025-31945

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain other users' charger information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31147

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30510

Growatt Cloud portal Insufficient Type Distinction

An attacker can upload an arbitrary file instead of a plant image.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30254

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31357

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain a user's plant list by knowing the username.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31933

Growatt Cloud Applications Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can check the existence of usernames in the system by querying an API.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31941

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31949

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An authenticated attacker can obtain any plant name by knowing the plant ID.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-24297

Growatt Cloud portal Cross-site Scripting

Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-24315

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-24850

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can export other users' plant information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-25276

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can hijack other users' devices and potentially control them.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-26857

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27561

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename "rooms" of arbitrary users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27565

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27575

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27719

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can query an API endpoint and get device details.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27927

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27929

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30257

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal