Medium · 5.3 CVE-2025-31949 EUVD-2025-11010GHSA-8f4x-4r5c-hrm5

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Published Apr 15, 2025 · Updated Apr 15, 2025 · Assigned by icscert

Description

An authenticated attacker can obtain any plant name by knowing the plant ID.

Vendor	Product	Affected	Fixed
Growatt	Cloud portal	≤ 3.6.0	—

ICSA-25-105-04 Growatt Cloud Applications CISA ICS & IT advisories · May 6, 2025