CVE-2025-13932: Soliscloud Monitoring Platform Cloud API & Device Control API

High severity, CVSS 8.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.

Affected products

• Soliscloud Monitoring Platform Cloud API & Device Control API

Published 2025-12-04. Last modified 2026-06-17.