Auth bypass in Growatt Https://oss.growatt.com
CVE-2025-29757
An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.
Vulnerability class: Broken Access Control
EPSS: 0.004 (30.3th percentile) — read the EPSS interpretation.
Affected products
- Growatt Https://oss.growatt.com — versions 0
- Growatt Https://server.growatt.com — versions 0
Weakness classification (CWE)
References
- csirt@divd.nl (product)
- csirt@divd.nl (product)
- csirt@divd.nl (third-party-advisory)
- csirt@divd.nl (third-party-advisory)