Browse CVEs

CRITICAL 9.8 CVE-2025-36752 Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the… Shine Lan X Firmware 3.6.0.2+ Fix from $2,3002025-12-13 CRITICAL 9.8 CVE-2025-36753 The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the de… Shine Lan X Firmware 3.6.0.2+ Fix from $2,3002025-12-13 MEDIUM 5.4 CVE-2025-36750 ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant manageme… Shine Lan X Firmware 3.6.0.2+ Fix from $1,6002025-12-13 CRITICAL 9.8 CVE-2025-36747 ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection wi… Shine Lan X Firmware 3.6.0.2+ Fix from $2,3002025-12-13 MEDIUM 5.4 CVE-2025-36748 ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inser… Shine Lan X Firmware 3.6.0.2+ Fix from $1,6002025-12-13 HIGH 7.5 CVE-2025-31360 Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Cloud Portal after 3.6.0 Fix from $1,9502025-04-15 MEDIUM 5.3 CVE-2025-31147 Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-31654 An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-31945 An unauthenticated attacker can obtain other users' charger information. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-31950 An unauthenticated attacker can obtain EV charger energy consumption information of other users. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 CRITICAL 9.8 CVE-2025-30510 An attacker can upload an arbitrary file instead of a plant image. Cloud Portal after 3.6.0 Fix from $2,3002025-04-15 MEDIUM 6.5 CVE-2025-30512 Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-30257 Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-27719 Unauthenticated attackers can query an API endpoint and get device details. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-27927 An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-27929 Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-27575 An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-27561 Unauthenticated attackers can rename "rooms" of arbitrary users. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-27565 An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-26857 Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 6.5 CVE-2025-25276 An unauthenticated attacker can hijack other users' devices and potentially control them. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-24315 Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-24850 An attacker can export other users' plant information. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 CRITICAL 9.8 CVE-2025-24297 Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. Cloud Portal after 3.6.0 Fix from $2,3002025-04-15 MEDIUM 5.3 CVE-2025-31933 An unauthenticated attacker can check the existence of usernames in the system by querying an API. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-31941 An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-31949 An authenticated attacker can obtain any plant name by knowing the plant ID. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-31357 An unauthenticated attacker can obtain a user's plant list by knowing the username. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.3 CVE-2025-30514 Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes"). Cloud Portal after 3.6.0 Fix from $1,6002025-04-15 MEDIUM 5.4 CVE-2025-30511 An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. Cloud Portal after 3.6.0 Fix from $1,6002025-04-15