CVE-2025-36754 | | | 2025-12-13 | The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new s… |
CVE-2025-36753 | Critical | 9.8 | 2025-12-13 | The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and t… |
CVE-2025-36752 | Critical | 9.8 | 2025-12-13 | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, s… |
CVE-2025-36751 | | | 2025-12-13 | Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept a… |
CVE-2025-36750 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page vi… |
CVE-2025-36748 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the… |
CVE-2025-36747 | Critical | 9.8 | 2025-12-13 | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser… |
CVE-2025-29757 | | | 2025-07-19 | An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer… |
CVE-2025-31950 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain EV charger energy consumption information of other users. |
CVE-2025-31945 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain other users' charger information. |
CVE-2025-31654 | Medium | 5.3 | 2025-04-15 | An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). |
CVE-2025-31360 | Medium | 6.5 | 2025-04-15 | Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. |
CVE-2025-31147 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. |
CVE-2025-30512 | Medium | 6.5 | 2025-04-15 | Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). |
CVE-2025-30510 | Critical | 9.8 | 2025-04-15 | An attacker can upload an arbitrary file instead of a plant image. |
CVE-2025-30257 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. |
CVE-2025-27929 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. |
CVE-2025-27927 | Medium | 5.3 | 2025-04-15 | An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. |
CVE-2025-27719 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can query an API endpoint and get device details. |
CVE-2025-27575 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. |
CVE-2025-27565 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. |
CVE-2025-27561 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can rename "rooms" of arbitrary users. |
CVE-2025-26857 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). |
CVE-2025-25276 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can hijack other users' devices and potentially control them. |
CVE-2025-24850 | Medium | 5.3 | 2025-04-15 | An attacker can export other users' plant information. |
CVE-2025-24315 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). |
CVE-2025-24297 | Critical | 9.8 | 2025-04-15 | Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. |
CVE-2025-31949 | Medium | 5.3 | 2025-04-15 | An authenticated attacker can obtain any plant name by knowing the plant ID. |
CVE-2025-31941 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. |
CVE-2025-31933 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can check the existence of usernames in the system by querying an API. |
CVE-2025-31357 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain a user's plant list by knowing the username. |
CVE-2025-30514 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes"). |
CVE-2025-30511 | High | 8.8 | 2025-04-15 | An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. |
CVE-2025-30254 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username. |
CVE-2025-27939 | High | 7.5 | 2025-04-15 | An attacker can change registered email addresses of other users and take over arbitrary accounts. |
CVE-2025-27938 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms"). |
CVE-2025-27568 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request. |
CVE-2025-24487 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can infer the existence of usernames in the system by querying an API. |