CVE-2025-27939: falha de média gravidade em Growatt Cloud portal
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.9%
An attacker can change registered email addresses of other users and take over arbitrary accounts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Growatt · Cloud portalCVEs relacionadas — Growatt Cloud portal
No mesmo produto, das mais perigosas para as menos.
CVE-2025-30512MEDIUMGrowatt Cloud portal External Control of System or Configuration SettingEPSS 0.7%CVE-2025-24315MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.7%CVE-2025-31945MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.6%CVE-2025-27719MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.6%CVE-2025-31360MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.6%CVE-2025-24297CRITICALGrowatt Cloud portal Cross-site ScriptingEPSS 0.5%