Vendor
Growatt
38 known vulnerabilities.
26 results · Clear filters · Feed
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
-
Medium 6.5
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
-
Medium 6.5
Growatt Cloud portal External Control of System or Configuration Setting
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can export other users' plant information.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can hijack other users' devices and potentially control them.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain other users' charger information.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query an API endpoint and get device details.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a user's plant list by knowing the username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An authenticated attacker can obtain any plant name by knowing the plant ID.
-
Medium 5.3
Growatt Cloud Applications Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can check the existence of usernames in the system by querying an API.