Auth bypass in Growatt Https://oss.growatt.com
CVE-2025-29757
An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.
Vulnerability class: Broken Access Control
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (31.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 31.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Growatt Https://oss.growatt.com — versions 0
- Growatt Https://server.growatt.com — versions 0
Weakness classification (CWE)
References
- server.growatt.com (product)
- oss.growatt.com (product)
- csirt.divd.nl/CVE-2025-29757 (third-party-advisory)
- csirt.divd.nl/DIVD-2025-00011 (third-party-advisory)