This page lists publicly disclosed CVE vulnerabilities affecting growatt cloud_portal (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-31950 | An unauthenticated attacker can obtain EV charger energy consumption information of other users. | [email protected] | 6.9 | 0.25% | 2025-04-15 | 2026-06-17 |
| CVE-2025-31945 | An unauthenticated attacker can obtain other users' charger information. | [email protected] | 6.9 | 0.56% | 2025-04-15 | 2026-06-17 |
| CVE-2025-31654 | An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). | [email protected] | 6.9 | 0.26% | 2025-04-15 | 2026-06-17 |
| CVE-2025-31360 | Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. | [email protected] | 6.9 | 0.48% | 2025-04-15 | 2026-06-17 |
| CVE-2025-31147 | Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. | [email protected] | 6.9 | 0.25% | 2025-04-15 | 2026-06-17 |
| CVE-2025-30512 | Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). | [email protected] | 6.9 | 0.57% | 2025-04-15 | 2026-06-17 |
| CVE-2025-30510 | An attacker can upload an arbitrary file instead of a plant image. | [email protected] | 9.3 | 0.22% | 2025-04-15 | 2026-06-17 |
| CVE-2025-30257 | Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. | [email protected] | 6.9 | 0.25% | 2025-04-15 | 2026-06-17 |
| CVE-2025-27929 | Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. | [email protected] | 6.9 | 0.25% | 2025-04-15 | 2026-06-17 |
| CVE-2025-27927 | An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. | [email protected] | 6.9 | 0.25% | 2025-04-15 | 2026-06-17 |
| CVE-2025-27719 | Unauthenticated attackers can query an API endpoint and get device details. | [email protected] | 6.9 | 0.56% | 2025-04-15 | 2026-06-17 |
| CVE-2025-27575 | An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. | [email protected] | 6.9 | 0.25% | 2025-04-15 | 2026-06-17 |
| CVE-2025-27565 | An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. | [email protected] | 6.9 | 0.26% | 2025-04-15 | 2026-06-17 |
| CVE-2025-27561 | Unauthenticated attackers can rename "rooms" of arbitrary users. | [email protected] | 6.9 | 0.26% | 2025-04-15 | 2026-06-17 |
| CVE-2025-26857 | Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). | [email protected] | 6.9 | 0.26% | 2025-04-15 | 2026-06-17 |
| CVE-2025-25276 | An unauthenticated attacker can hijack other users' devices and potentially control them. | [email protected] | 6.9 | 0.26% | 2025-04-15 | 2026-06-17 |
| CVE-2025-24850 | An attacker can export other users' plant information. | [email protected] | 6.9 | 0.26% | 2025-04-15 | 2026-06-17 |
| CVE-2025-24315 | Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). | [email protected] | 6.9 | 0.57% | 2025-04-15 | 2026-06-17 |
| CVE-2025-24297 | Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. | [email protected] | 9.3 | 0.48% | 2025-04-15 | 2026-06-17 |
| CVE-2025-31949 | An authenticated attacker can obtain any plant name by knowing the plant ID. | [email protected] | 6.9 | 0.26% | 2025-04-15 | 2026-06-17 |