cloud portal vulnerabilities and fixes

Recent CVEs affecting cloud portal, with upgrade or downgrade steps. 30 tracked.

Also searched as: cloudportal.

cloud portal has 30 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 30. Most recent: 2025-04-15. Highest priority: CVE-2025-24297 (score 50/100).

• CVE-2025-31950 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain EV charger energy consumption information of other users.
• CVE-2025-31949 MEDIUM 5.3 UPGRADE An authenticated attacker can obtain any plant name by knowing the plant ID.
• CVE-2025-31945 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain other users' charger information.
• CVE-2025-31941 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
• CVE-2025-31933 MEDIUM 5.3 UPGRADE An unauthenticated attacker can check the existence of usernames in the system by querying an API.
• CVE-2025-31654 MEDIUM 5.3 UPGRADE An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms")
• CVE-2025-31360 MEDIUM 6.5 UPGRADE Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
• CVE-2025-31357 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain a user's plant list by knowing the username.
• CVE-2025-31147 MEDIUM 5.3 UPGRADE Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
• CVE-2025-30514 MEDIUM 5.3 UPGRADE Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "sc
• CVE-2025-30512 MEDIUM 6.5 UPGRADE Unauthenticated attackers can send configuration settings to device and possible perform physical actions remo
• CVE-2025-30511 HIGH 8.8 UPGRADE An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value w
• CVE-2025-30510 CRITICAL 9.8 UPGRADE An attacker can upload an arbitrary file instead of a plant image.
• CVE-2025-30257 MEDIUM 5.3 UPGRADE Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
• CVE-2025-30254 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
• CVE-2025-27939 HIGH 7.5 UPGRADE An attacker can change registered email addresses of other users and take over arbitrary accounts.
• CVE-2025-27938 MEDIUM 5.3 UPGRADE Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "ro
• CVE-2025-27929 MEDIUM 5.3 UPGRADE Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
• CVE-2025-27927 MEDIUM 5.3 UPGRADE An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprote
• CVE-2025-27719 MEDIUM 5.3 UPGRADE Unauthenticated attackers can query an API endpoint and get device details.
• CVE-2025-27575 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charge
• CVE-2025-27568 MEDIUM 5.3 UPGRADE An unauthenticated attacker can get users' emails by knowing usernames
• CVE-2025-27565 MEDIUM 5.3 UPGRADE An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
• CVE-2025-27561 MEDIUM 5.3 UPGRADE Unauthenticated attackers can rename "rooms" of arbitrary users.
• CVE-2025-26857 MEDIUM 5.3 UPGRADE Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
• CVE-2025-25276 MEDIUM 5.3 UPGRADE An unauthenticated attacker can hijack other users' devices and potentially control them.
• CVE-2025-24850 MEDIUM 5.3 UPGRADE An attacker can export other users' plant information.
• CVE-2025-24487 MEDIUM 5.3 UPGRADE An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
• CVE-2025-24315 MEDIUM 5.3 UPGRADE Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitra
• CVE-2025-24297 CRITICAL 9.8 UPGRADE Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users persona

FAQ

How do I fix cloud portal vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is cloud portal being exploited right now?

None of the tracked cloud portal CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which cloud portal CVE should I patch first?

CVE-2025-24297 currently ranks highest (50/100): Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users persona.

RSS feed for cloud portal · ← Back to latest CVEs