Growatt
growatt
35 CVEs • 3 products
Products (3)
Click to collapseToggle
Products (3)
Click to collapse
CVEs (35)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
An unauthenticated attacker can hijack other users' devices and potentially control them. |
An attacker can export other users' plant information. |
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). |
Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. |
An authenticated attacker can obtain any plant name by knowing the plant ID. |
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. |
An unauthenticated attacker can check the existence of usernames in the system by querying an API. |
An unauthenticated attacker can obtain a user's plant list by knowing the username. |
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes"). |
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. |
An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username. |
An attacker can change registered email addresses of other users and take over arbitrary accounts. |
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms"). |
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request. |
An unauthenticated attacker can infer the existence of usernames in the system by querying an API. |