Growatt Cloud Portal — known CVE vulnerabilities

Every CVE whose affected-product data names Growatt Cloud Portal, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (30)

• CVE-2025-30510 — CVSS 9.8 (critical): An attacker can upload an arbitrary file instead of a plant image.
• CVE-2025-24297 — CVSS 9.8 (critical): Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.
• CVE-2025-30511 — CVSS 8.8 (high): An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a…
• CVE-2025-27939 — CVSS 7.5 (high): An attacker can change registered email addresses of other users and take over arbitrary accounts.
• CVE-2025-30512 — CVSS 6.5 (medium): Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
• CVE-2025-31360 — CVSS 6.5 (medium): Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
• CVE-2025-27561 — CVSS 5.3 (medium): Unauthenticated attackers can rename "rooms" of arbitrary users.
• CVE-2025-27565 — CVSS 5.3 (medium): An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
• CVE-2025-27568 — CVSS 5.3 (medium): An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited…
• CVE-2025-27575 — CVSS 5.3 (medium): An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
• CVE-2025-27719 — CVSS 5.3 (medium): Unauthenticated attackers can query an API endpoint and get device details.
• CVE-2025-27927 — CVSS 5.3 (medium): An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
• CVE-2025-27929 — CVSS 5.3 (medium): Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
• CVE-2025-27938 — CVSS 5.3 (medium): Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
• CVE-2025-30254 — CVSS 5.3 (medium): An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
• CVE-2025-30257 — CVSS 5.3 (medium): Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
• CVE-2025-30514 — CVSS 5.3 (medium): Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
• CVE-2025-31147 — CVSS 5.3 (medium): Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
• CVE-2025-31357 — CVSS 5.3 (medium): An unauthenticated attacker can obtain a user's plant list by knowing the username.
• CVE-2025-31654 — CVSS 5.3 (medium): An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
• CVE-2025-31933 — CVSS 5.3 (medium): An unauthenticated attacker can check the existence of usernames in the system by querying an API.
• CVE-2025-31941 — CVSS 5.3 (medium): An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
• CVE-2025-31945 — CVSS 5.3 (medium): An unauthenticated attacker can obtain other users' charger information.
• CVE-2025-31949 — CVSS 5.3 (medium): An authenticated attacker can obtain any plant name by knowing the plant ID.
• CVE-2025-31950 — CVSS 5.3 (medium): An unauthenticated attacker can obtain EV charger energy consumption information of other users.
• CVE-2025-24315 — CVSS 5.3 (medium): Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
• CVE-2025-24487 — CVSS 5.3 (medium): An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
• CVE-2025-24850 — CVSS 5.3 (medium): An attacker can export other users' plant information.
• CVE-2025-25276 — CVSS 5.3 (medium): An unauthenticated attacker can hijack other users' devices and potentially control them.
• CVE-2025-26857 — CVSS 5.3 (medium): Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).