CVE-2025-24297 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-79 (Improper Neutralization of Input). 🔍 **Flaw**: Insufficient server-side input validation. The system fails to sanitize user inputs, allowing script execution.

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: Growatt (China). 📦 **Product**: Cloud portal / Monitoring platform. 📉 **Affected**: Version **3.6.0** and all earlier versions.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🔓 **Auth**: No privileges required (PR:N). 🖱️ **UI**: No user interaction needed (UI:N). 🌐 **Network**: Network accessible (AV:N). 🎯 **Difficulty**: Low complexity (AC:L).

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: No specific PoC listed in the data. 🌍 **Wild Exp**: None reported yet. ⚠️ **Note**: CISA Advisory (ICSA-25-105-04) highlights the risk, but code-level exploits are not public.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Upgrade to a version **newer than 3.6.0**. 📥 **Source**: Check official Growatt support channels for the patched release. 📝 **Ref**: See CISA Advisory ICSA-25-105-04 for official guidance.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 📈 **CVSS**: 9.8 (Critical). ⏱️ **Action**: Patch immediately. No auth/UI interaction needed makes this easy to exploit. Prioritize for ICS/OT environments.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Cross-Site Scripting (XSS) in Growatt Cloud Applications. <br>💥 **Consequences**: Attackers inject malicious JavaScript. This leads to **High** impact on Confidentiality, Integrity, and Availability.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-79 (Improper Neutralization of Input). <br>🔍 **Flaw**: Insufficient server-side input validation. The system fails to sanitize user inputs, allowing script execution.

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: Growatt (China). <br>📦 **Product**: Cloud portal / Monitoring platform. <br>📉 **Affected**: Version **3.6.0** and all earlier versions.

Q4What can hackers do? (Privileges/Data)

💻 **Hacker Actions**: Execute arbitrary JavaScript in victims' browsers. <br>🔑 **Privileges**: Steal cookies/sessions, redirect users, or deface pages.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: No privileges required (PR:N). <br>🖱️ **UI**: No user interaction needed (UI:N). <br>🌐 **Network**: Network accessible (AV:N). <br>🎯 **Difficulty**: Low complexity (AC:L).

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: No specific PoC listed in the data. <br>🌍 **Wild Exp**: None reported yet. <br>⚠️ **Note**: CISA Advisory (ICSA-25-105-04) highlights the risk, but code-level exploits are not public.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **Growatt Cloud Applications** versions ≤ 3.6.0. <br>🧪 **Test**: Input `<script>alert(1)</script>` into search/login fields. If it executes, you are vulnerable.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Upgrade to a version **newer than 3.6.0**. <br>📥 **Source**: Check official Growatt support channels for the patched release. <br>📝 **Ref**: See CISA Advisory ICSA-25-105-04 for official guidance.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If patching is delayed, implement **WAF rules** to block script tags (`<script>`, `onerror`, etc.).…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. <br>📈 **CVSS**: 9.8 (Critical). <br>⏱️ **Action**: Patch immediately. No auth/UI interaction needed makes this easy to exploit. Prioritize for ICS/OT environments.

Continue exploring

Vulnerability detail Full AI analysis (login) Growatt CWE-79