Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2025-29757

An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/h

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DIVD

Description

An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Growatt https://oss.growatt.com

Default version status: unaffected

  • 0 to < 13 Jun 2025affected

Growatt https://server.growatt.com

Default version status: unaffected

  • 0 to < 13 June 2025affected

References