Description
An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Growatt | https://oss.growatt.com | < 13 Jun 2025 | 13 Jun 2025 |
| Growatt | https://server.growatt.com | < 13 June 2025 | 13 June 2025 |
References
- https://server.growatt.com product
- https://oss.growatt.com product
- https://csirt.divd.nl/CVE-2025-29757 third-party-advisory
- https://csirt.divd.nl/DIVD-2025-00011 third-party-advisory