growatt vulnerabilities

Recent CVEs affecting growatt products. 35 tracked.

growatt has 35 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 35. Most recent: 2025-12-13. Highest priority: CVE-2025-24297 (score 50/100).

CVE-2025-36747 CRITICAL 9.8 UPGRADE ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to
CVE-2025-36752 CRITICAL 9.8 UPGRADE Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which
CVE-2025-36753 CRITICAL 9.8 UPGRADE The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an at
CVE-2025-36748 MEDIUM 5.4 UPGRADE ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server
CVE-2025-36750 MEDIUM 5.4 UPGRADE ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field
CVE-2025-31950 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain EV charger energy consumption information of other users.
CVE-2025-31949 MEDIUM 5.3 UPGRADE An authenticated attacker can obtain any plant name by knowing the plant ID.
CVE-2025-31945 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain other users' charger information.
CVE-2025-31941 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
CVE-2025-31933 MEDIUM 5.3 UPGRADE An unauthenticated attacker can check the existence of usernames in the system by querying an API.
CVE-2025-31654 MEDIUM 5.3 UPGRADE An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms")
CVE-2025-31360 MEDIUM 6.5 UPGRADE Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
CVE-2025-31357 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain a user's plant list by knowing the username.
CVE-2025-31147 MEDIUM 5.3 UPGRADE Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
CVE-2025-30514 MEDIUM 5.3 UPGRADE Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "sc
CVE-2025-30512 MEDIUM 6.5 UPGRADE Unauthenticated attackers can send configuration settings to device and possible perform physical actions remo
CVE-2025-30511 HIGH 8.8 UPGRADE An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value w
CVE-2025-30510 CRITICAL 9.8 UPGRADE An attacker can upload an arbitrary file instead of a plant image.
CVE-2025-30257 MEDIUM 5.3 UPGRADE Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
CVE-2025-30254 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
CVE-2025-27939 HIGH 7.5 UPGRADE An attacker can change registered email addresses of other users and take over arbitrary accounts.
CVE-2025-27938 MEDIUM 5.3 UPGRADE Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "ro
CVE-2025-27929 MEDIUM 5.3 UPGRADE Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
CVE-2025-27927 MEDIUM 5.3 UPGRADE An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprote
CVE-2025-27719 MEDIUM 5.3 UPGRADE Unauthenticated attackers can query an API endpoint and get device details.
CVE-2025-27575 MEDIUM 5.3 UPGRADE An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charge
CVE-2025-27568 MEDIUM 5.3 UPGRADE An unauthenticated attacker can get users' emails by knowing usernames
CVE-2025-27565 MEDIUM 5.3 UPGRADE An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
CVE-2025-27561 MEDIUM 5.3 UPGRADE Unauthenticated attackers can rename "rooms" of arbitrary users.
CVE-2025-26857 MEDIUM 5.3 UPGRADE Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
CVE-2025-25276 MEDIUM 5.3 UPGRADE An unauthenticated attacker can hijack other users' devices and potentially control them.
CVE-2025-24850 MEDIUM 5.3 UPGRADE An attacker can export other users' plant information.
CVE-2025-24487 MEDIUM 5.3 UPGRADE An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
CVE-2025-24315 MEDIUM 5.3 UPGRADE Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitra
CVE-2025-24297 CRITICAL 9.8 UPGRADE Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users persona

FAQ

How do I fix growatt vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is growatt being exploited right now?

None of the tracked growatt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which growatt CVE should I patch first?

CVE-2025-24297 currently ranks highest (50/100): Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users persona.

Products

RSS feed for growatt · ← Back to latest CVEs