← All advisories

Critical severity9.8NVD Advisory· Published Apr 15, 2025· Updated Jun 17, 2026

CVE-2025-24297

CVE-2025-24297

Description

Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.

Affected products

2

Growatt/Cloud Portal2 versions
cpe:2.3:a:growatt:cloud_portal:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:growatt:cloud_portal:*:*:*:*:*:*:*:*range: <=3.6.0
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

1

www.cisa.gov/news-events/ics-advisories/icsa-25-105-04nvdMitigationThird Party AdvisoryUS Government Resource

News mentions

0

No linked articles in our index yet.