Medium · 5.3 CVE-2025-27938 EUVD-2025-10995GHSA-j9qf-mqgv-w6rw

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Published Apr 15, 2025 · Updated Apr 16, 2025 · Assigned by icscert

Description

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").

Vendor	Product	Affected	Fixed
Growatt	Cloud portal	< 3.6.0	3.6.0

ICSA-25-105-04 Growatt Cloud Applications CISA ICS & IT advisories · May 6, 2025