# cve.now: Growatt

The newest entries naming Growatt as an affected vendor (up to 200), of 38 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-36747](https://cve.now/CVE-2025-36747.md): Hardcoded FTP Credentials within the firmware (CVSS 9.4)
- [CVE-2025-36752](https://cve.now/CVE-2025-36752.md): Undocumented backup Account and No Password Configuration Capability (CVSS 9.4)
- [CVE-2025-36754](https://cve.now/CVE-2025-36754.md): Authentication bypass on web interface (CVSS 9.3)
- [CVE-2025-36748](https://cve.now/CVE-2025-36748.md): Stored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-X (CVSS 8.4)
- [CVE-2025-36750](https://cve.now/CVE-2025-36750.md): Stored cross site scripting (XSS) vulnerability in Growatt ShineLan-X (CVSS 8.5)
- [CVE-2025-36753](https://cve.now/CVE-2025-36753.md): SWD Interface Open on Growatt ShineLan-X (CVSS 8.6)
- [CVE-2025-36751](https://cve.now/CVE-2025-36751.md): Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X (CVSS 9.4)
- [CVE-2025-29757](https://cve.now/CVE-2025-29757.md): An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid (CVSS 9.4)
- [CVE-2025-27929](https://cve.now/CVE-2025-27929.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-24315](https://cve.now/CVE-2025-24315.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-27561](https://cve.now/CVE-2025-27561.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-30257](https://cve.now/CVE-2025-30257.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31147](https://cve.now/CVE-2025-31147.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31360](https://cve.now/CVE-2025-31360.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-30512](https://cve.now/CVE-2025-30512.md): Growatt Cloud portal External Control of System or Configuration Setting (CVSS 6.9)
- [CVE-2025-27927](https://cve.now/CVE-2025-27927.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-24297](https://cve.now/CVE-2025-24297.md): Growatt Cloud portal Cross-site Scripting (CVSS 9.3)
- [CVE-2025-30510](https://cve.now/CVE-2025-30510.md): Growatt Cloud portal Insufficient Type Distinction (CVSS 9.3)
- [CVE-2025-24850](https://cve.now/CVE-2025-24850.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-25276](https://cve.now/CVE-2025-25276.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-27565](https://cve.now/CVE-2025-27565.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-27575](https://cve.now/CVE-2025-27575.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31950](https://cve.now/CVE-2025-31950.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31945](https://cve.now/CVE-2025-31945.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-26857](https://cve.now/CVE-2025-26857.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-27719](https://cve.now/CVE-2025-27719.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31654](https://cve.now/CVE-2025-31654.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-30514](https://cve.now/CVE-2025-30514.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-27938](https://cve.now/CVE-2025-27938.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-27939](https://cve.now/CVE-2025-27939.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-30254](https://cve.now/CVE-2025-30254.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-27568](https://cve.now/CVE-2025-27568.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-24487](https://cve.now/CVE-2025-24487.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31941](https://cve.now/CVE-2025-31941.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31357](https://cve.now/CVE-2025-31357.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31949](https://cve.now/CVE-2025-31949.md): Growatt Cloud portal Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-31933](https://cve.now/CVE-2025-31933.md): Growatt Cloud Applications Authorization Bypass Through User-Controlled Key (CVSS 6.9)
- [CVE-2025-30511](https://cve.now/CVE-2025-30511.md): Growatt Cloud Applications Cross-site Scripting (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/growatt
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.