CVE-2025-29757: Growatt Https://oss.growatt.com

Critical severity, CVSS 9.4. EPSS: 0.4% chance of exploitation in the next 30 days.

An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.

Affected products

• Growatt Https://oss.growatt.com: before 13 Jun 2025 (fixed in 13 Jun 2025)
• Growatt Https://server.growatt.com: before 13 June 2025 (fixed in 13 June 2025)

Published 2025-07-19. Last modified 2026-06-17.