CVE-2025-29757

An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.

Score

CVSS 4.0 9.4 Critical

Status

Deferred - csirt@divd.nl

Published

2025-07-19

Last modified

2025-07-22

Weaknesses

CWE-863

Affected products

• Httpsoss.growatt.com (Growatt)
• Httpsserver.growatt.com (Growatt)

References

• https://csirt.divd.nl/CVE-2025-29757
• https://csirt.divd.nl/DIVD-2025-00011
• https://oss.growatt.com
• https://server.growatt.com