Arbitrary User Room Renaming Vulnerability in Affected Product by Vendor
CVE-2025-27561

6.9MEDIUM

Key Information:

Vendor

Growatt

Status
Cloud Portal
Vendor
CVE Published:
15 April 2025

What is CVE-2025-27561?

A key vulnerability allows unauthenticated attackers to exploit the system and rename 'rooms' linked to any user. This could lead to misinformation and potential unauthorized access, posing security risks within the application. Mitigation steps must be implemented promptly to protect user data and maintain system integrity.

Affected Version(s)

Cloud portal 0 < 3.6.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Forescout Technologies reported these vulnerabilities to CISA.
.