Total
30 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-27575 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. | |||||
| CVE-2025-27568 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request. | |||||
| CVE-2025-27565 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. | |||||
| CVE-2025-27561 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| Unauthenticated attackers can rename "rooms" of arbitrary users. | |||||
| CVE-2025-26857 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). | |||||
| CVE-2025-25276 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| An unauthenticated attacker can hijack other users' devices and potentially control them. | |||||
| CVE-2025-24850 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| An attacker can export other users' plant information. | |||||
| CVE-2025-24487 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| An unauthenticated attacker can infer the existence of usernames in the system by querying an API. | |||||
| CVE-2025-24315 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). | |||||
| CVE-2025-24297 | 1 Growatt | 1 Cloud Portal | 2026-06-17 | N/A | 9.8 CRITICAL |
| Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. | |||||