Description
The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SolisCloud | Monitoring Platform (Cloud API & Device Control API) | API v1, API v2 | — |
Advisories 1
- ICSA-25-338-06 SolisCloud Monitoring Platform CISA ICS & IT advisories · Dec 4, 2025
References
- url government-resource