Growatt
Growatt Cloud Portal: vulnerabilidades y CVE
Growatt Cloud Portal tiene 30 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE30
Últimos 12 meses0
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-31950 | Media (6.9) | 0.31% | — | 15 abr 2025 | An unauthenticated attacker can obtain EV charger energy consumption information of other users. |
| CVE-2025-31945 | Media (6.9) | 0.58% | — | 15 abr 2025 | An unauthenticated attacker can obtain other users' charger information. |
| CVE-2025-31654 | Media (6.9) | 0.30% | — | 15 abr 2025 | An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). |
| CVE-2025-31360 | Media (6.9) | 0.54% | — | 15 abr 2025 | Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. |
| CVE-2025-31147 | Media (6.9) | 0.31% | — | 15 abr 2025 | Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. |
| CVE-2025-30512 | Media (6.9) | 0.64% | — | 15 abr 2025 | Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). |
| CVE-2025-30510 | Crítica (9.3) | 0.26% | — | 15 abr 2025 | An attacker can upload an arbitrary file instead of a plant image. |
| CVE-2025-30257 | Media (6.9) | 0.31% | — | 15 abr 2025 | Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. |
| CVE-2025-27929 | Media (6.9) | 0.31% | — | 15 abr 2025 | Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. |
| CVE-2025-27927 | Media (6.9) | 0.31% | — | 15 abr 2025 | An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. |
| CVE-2025-27719 | Media (6.9) | 0.58% | — | 15 abr 2025 | Unauthenticated attackers can query an API endpoint and get device details. |
| CVE-2025-27575 | Media (6.9) | 0.31% | — | 15 abr 2025 | An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. |
| CVE-2025-27565 | Media (6.9) | 0.29% | — | 15 abr 2025 | An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. |
| CVE-2025-27561 | Media (6.9) | 0.29% | — | 15 abr 2025 | Unauthenticated attackers can rename "rooms" of arbitrary users. |
| CVE-2025-26857 | Media (6.9) | 0.31% | — | 15 abr 2025 | Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). |
| CVE-2025-25276 | Media (6.9) | 0.31% | — | 15 abr 2025 | An unauthenticated attacker can hijack other users' devices and potentially control them. |
| CVE-2025-24850 | Media (6.9) | 0.36% | — | 15 abr 2025 | An attacker can export other users' plant information. |
| CVE-2025-24315 | Media (6.9) | 0.64% | — | 15 abr 2025 | Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). |
| CVE-2025-24297 | Crítica (9.3) | 0.50% | — | 15 abr 2025 | Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. |
| CVE-2025-31949 | Media (6.9) | 0.30% | — | 15 abr 2025 | An authenticated attacker can obtain any plant name by knowing the plant ID. |
| CVE-2025-31941 | Media (6.9) | 0.31% | — | 15 abr 2025 | An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. |
| CVE-2025-31933 | Media (6.9) | 0.31% | — | 15 abr 2025 | An unauthenticated attacker can check the existence of usernames in the system by querying an API. |
| CVE-2025-31357 | Media (6.9) | 0.31% | — | 15 abr 2025 | An unauthenticated attacker can obtain a user's plant list by knowing the username. |
| CVE-2025-30514 | Media (6.9) | 0.49% | — | 15 abr 2025 | Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes"). |
| CVE-2025-30511 | Alta (8.7) | 0.39% | — | 15 abr 2025 | An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. |
| CVE-2025-30254 | Media (6.9) | 0.49% | — | 15 abr 2025 | An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username. |
| CVE-2025-27939 | Media (6.9) | 0.84% | — | 15 abr 2025 | An attacker can change registered email addresses of other users and take over arbitrary accounts. |
| CVE-2025-27938 | Media (6.9) | 0.49% | — | 15 abr 2025 | Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms"). |
| CVE-2025-27568 | Media (6.9) | 0.49% | — | 15 abr 2025 | An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request. |
| CVE-2025-24487 | Media (6.9) | 0.49% | — | 15 abr 2025 | An unauthenticated attacker can infer the existence of usernames in the system by querying an API. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.