CVE-2025-13932 — SolisCloud / Monitoring Platform (Cloud API & Device Control API)

CVE-2025-13932

SolisCloud / Monitoring Platform (Cloud API & Device Control API) PUBLISHED

Description (CNA)

The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.

Affected (CNA)

Vendor / product	Versions
SolisCloud / Monitoring Platform (Cloud API & Device Control API)	affected API v1; affected API v2

CWE

CWE-639

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-06

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.