Growatt

38 CVEs across 7 Growatt products. Browse Growatt vulnerabilities, severities, and proof-of-concept exploits.

Growatt products with known CVEs

ProductCVEs
Cloud Portal30
Cloud Portal30
Shinelan-X7
Shine Lan-X5
Shine Lan-X Firmware5
Https://oss.growatt.com1
Https://server.growatt.com1
Growatt CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-367542025-12-13The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new s…
CVE-2025-36753Critical9.82025-12-13The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and t…
CVE-2025-36752Critical9.82025-12-13Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, s…
CVE-2025-367512025-12-13Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept a…
CVE-2025-36750Medium5.42025-12-13ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page vi…
CVE-2025-36748Medium5.42025-12-13ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the…
CVE-2025-36747Critical9.82025-12-13ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser…
CVE-2025-297572025-07-19An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer…
CVE-2025-31950Medium5.32025-04-15An unauthenticated attacker can obtain EV charger energy consumption information of other users.
CVE-2025-31945Medium5.32025-04-15An unauthenticated attacker can obtain other users' charger information.
CVE-2025-31654Medium5.32025-04-15An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
CVE-2025-31360Medium6.52025-04-15Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
CVE-2025-31147Medium5.32025-04-15Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
CVE-2025-30512Medium6.52025-04-15Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
CVE-2025-30510Critical9.82025-04-15An attacker can upload an arbitrary file instead of a plant image.
CVE-2025-30257Medium5.32025-04-15Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
CVE-2025-27929Medium5.32025-04-15Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
CVE-2025-27927Medium5.32025-04-15An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
CVE-2025-27719Medium5.32025-04-15Unauthenticated attackers can query an API endpoint and get device details.
CVE-2025-27575Medium5.32025-04-15An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
CVE-2025-27565Medium5.32025-04-15An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
CVE-2025-27561Medium5.32025-04-15Unauthenticated attackers can rename "rooms" of arbitrary users.
CVE-2025-26857Medium5.32025-04-15Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
CVE-2025-25276Medium5.32025-04-15An unauthenticated attacker can hijack other users' devices and potentially control them.
CVE-2025-24850Medium5.32025-04-15An attacker can export other users' plant information.
CVE-2025-24315Medium5.32025-04-15Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
CVE-2025-24297Critical9.82025-04-15Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.
CVE-2025-31949Medium5.32025-04-15An authenticated attacker can obtain any plant name by knowing the plant ID.
CVE-2025-31941Medium5.32025-04-15An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
CVE-2025-31933Medium5.32025-04-15An unauthenticated attacker can check the existence of usernames in the system by querying an API.
CVE-2025-31357Medium5.32025-04-15An unauthenticated attacker can obtain a user's plant list by knowing the username.
CVE-2025-30514Medium5.32025-04-15Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
CVE-2025-30511High8.82025-04-15An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.
CVE-2025-30254Medium5.32025-04-15An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
CVE-2025-27939High7.52025-04-15An attacker can change registered email addresses of other users and take over arbitrary accounts.
CVE-2025-27938Medium5.32025-04-15Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
CVE-2025-27568Medium5.32025-04-15An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
CVE-2025-24487Medium5.32025-04-15An unauthenticated attacker can infer the existence of usernames in the system by querying an API.