Summary
Successful exploitation of these vulnerabilities could allow an attacker to compromise confidentiality, achieve cross-site scripting, or code execution on affected devices.
Vulnerabilities 30
-
Critical 9.8
Growatt Cloud portal Cross-site Scripting
Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.
-
Critical 9.8
Growatt Cloud portal Insufficient Type Distinction
An attacker can upload an arbitrary file instead of a plant image.
-
High 8.8
Growatt Cloud Applications Cross-site Scripting
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.
-
High 7.5
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can change registered email addresses of other users and take over arbitrary accounts.
-
Medium 6.5
Growatt Cloud portal External Control of System or Configuration Setting
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
-
Medium 6.5
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can export other users' plant information.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can hijack other users' devices and potentially control them.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query an API endpoint and get device details.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a user's plant list by knowing the username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
-
Medium 5.3
Growatt Cloud Applications Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can check the existence of usernames in the system by querying an API.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain other users' charger information.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An authenticated attacker can obtain any plant name by knowing the plant ID.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
Revision history
-
#2
Revision - Fixing typos
-
#1
Initial Publication
References
-
ICSA Advisory ICSA-25-105-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B