CVE-2025-29757

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:C/RE:X/U:X

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-29765.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the componen CVE-2025-297664.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on arti CVE-2025-297684.4Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impac CVE-2025-297695.5libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence CVE-2025-29775.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown func CVE-2025-297706.5vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vL CVE-2025-297715.3HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used CVE-2025-297726.1OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcatego CVE-2025-297737.8Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or custome CVE-2025-297749.3xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions pr CVE-2025-297759.3xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions pr CVE-2025-297768.7Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` cau