Growatt ≫ Cloud Portal

An attacker can export other users' plant information.

An unauthenticated attacker can hijack other users' devices and potentially control them.

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

An unauthenticated attacker can obtain EV charger energy consumption information of other users.

An unauthenticated attacker can obtain other users' charger information.

Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

Unauthenticated attackers can query an API endpoint and get device details.

An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").