Cloud Portal
CVE-2025-31360
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
AnalysisAI
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-639. Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Affected products include: Growatt Cloud Portal.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Cloud Portal
View allDue to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces o
An attacker can upload an arbitrary file instead of a plant image. Rated critical severity (CVSS 9.3), this vulnerabilit
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while addin
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g.
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. Rated medium severity (CVS
Unauthenticated attackers can rename "rooms" of arbitrary users. Rated medium severity (CVSS 6.9), this vulnerability is
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
An unauthenticated attacker can hijack other users' devices and potentially control them. Rated medium severity (CVSS 6.
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). Rated medium severity (CV
An unauthenticated attacker can obtain EV charger energy consumption information of other users. Rated medium severity (
An unauthenticated attacker can obtain other users' charger information. Rated medium severity (CVSS 6.9), this vulnerab
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. Rated med
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today