Cloud Portal
by Growatt
CVEs (30)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-30510 | Cri | 0.64 | 9.8 | 0.00 | Apr 15, 2025 | An attacker can upload an arbitrary file instead of a plant image. | ||
| CVE-2025-24297 | Cri | 0.64 | 9.8 | 0.00 | Apr 15, 2025 | Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. | ||
| CVE-2025-30511 | Hig | 0.57 | 8.8 | 0.00 | Apr 15, 2025 | An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. | ||
| CVE-2025-27939 | Hig | 0.49 | 7.5 | 0.01 | Apr 15, 2025 | An attacker can change registered email addresses of other users and take over arbitrary accounts. | ||
| CVE-2025-31360 | Med | 0.42 | 6.5 | 0.01 | Apr 15, 2025 | Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. | ||
| CVE-2025-30512 | Med | 0.42 | 6.5 | 0.01 | Apr 15, 2025 | Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). | ||
| CVE-2025-31950 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | An unauthenticated attacker can obtain EV charger energy consumption information of other users. | ||
| CVE-2025-31945 | Med | 0.34 | 5.3 | 0.01 | Apr 15, 2025 | An unauthenticated attacker can obtain other users' charger information. | ||
| CVE-2025-31654 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). | ||
| CVE-2025-31147 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. | ||
| CVE-2025-30257 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. | ||
| CVE-2025-27929 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. | ||
| CVE-2025-27927 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. | ||
| CVE-2025-27719 | Med | 0.34 | 5.3 | 0.01 | Apr 15, 2025 | Unauthenticated attackers can query an API endpoint and get device details. | ||
| CVE-2025-27575 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. | ||
| CVE-2025-27565 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. | ||
| CVE-2025-27561 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | Unauthenticated attackers can rename "rooms" of arbitrary users. | ||
| CVE-2025-26857 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). | ||
| CVE-2025-25276 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | An unauthenticated attacker can hijack other users' devices and potentially control them. | ||
| CVE-2025-24850 | Med | 0.34 | 5.3 | 0.00 | Apr 15, 2025 | An attacker can export other users' plant information. |
- risk 0.64cvss 9.8epss 0.00
An attacker can upload an arbitrary file instead of a plant image.
- risk 0.64cvss 9.8epss 0.00
Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.
- risk 0.57cvss 8.8epss 0.00
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.
- risk 0.49cvss 7.5epss 0.01
An attacker can change registered email addresses of other users and take over arbitrary accounts.
- risk 0.42cvss 6.5epss 0.01
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
- risk 0.42cvss 6.5epss 0.01
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
- risk 0.34cvss 5.3epss 0.00
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
- risk 0.34cvss 5.3epss 0.01
An unauthenticated attacker can obtain other users' charger information.
- risk 0.34cvss 5.3epss 0.00
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
- risk 0.34cvss 5.3epss 0.00
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
- risk 0.34cvss 5.3epss 0.00
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
- risk 0.34cvss 5.3epss 0.01
Unauthenticated attackers can query an API endpoint and get device details.
- risk 0.34cvss 5.3epss 0.00
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
- risk 0.34cvss 5.3epss 0.00
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated attackers can rename "rooms" of arbitrary users.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
- risk 0.34cvss 5.3epss 0.00
An unauthenticated attacker can hijack other users' devices and potentially control them.
- risk 0.34cvss 5.3epss 0.00
An attacker can export other users' plant information.
Page 1 of 2