CVE-2025-24315 Overview
CVE-2025-24315 is an access control vulnerability affecting the Growatt Cloud Portal. Unauthenticated attackers can add devices belonging to other users into their own scenes, or into arbitrary scenes of arbitrary users. The flaw is classified under CWE-639, Authorization Bypass Through User-Controlled Key, and stems from the portal accepting device and scene identifiers without validating the requester's ownership or authenticating the caller.
Critical Impact
Attackers without credentials can manipulate scene membership across accounts, altering how other users' solar and energy devices are grouped and controlled through the Growatt cloud service.
Affected Products
- Growatt Cloud Portal (cloud service, all versions prior to vendor remediation)
Discovery Timeline
- 2025-04-15 - CVE-2025-24315 published to the National Vulnerability Database
- 2025-04-15 - CISA ICS Advisory ICSA-25-105-04 released
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24315
Vulnerability Analysis
The Growatt Cloud Portal exposes API endpoints that let users organize devices into scenes for grouped monitoring and control. The endpoint responsible for associating a device with a scene does not verify that the caller owns the referenced device or scene. It also does not require authentication. An attacker can supply an arbitrary device identifier and an arbitrary scene identifier to attach victim-owned equipment to any scene in the platform.
The issue falls under the Broken Access Control category and matches the CWE-639 pattern of Insecure Direct Object Reference. Device identifiers are the user-controlled key, and the server treats them as authoritative rather than as untrusted input to be checked against session context. Exploitation requires only network access to the public cloud portal and knowledge or enumeration of target device identifiers.
Root Cause
The root cause is missing authorization and missing authentication on the scene-management API. The backend performs the requested state change based on request parameters alone. Ownership binding between the authenticated principal, the device, and the scene is not enforced server-side.
Attack Vector
Exploitation occurs over the network against the public Growatt cloud endpoint. No privileges, user interaction, or prior session are required. An attacker crafts an HTTP request that references a target device identifier and a target scene identifier, and the server accepts the modification. Technical exploitation details are described in CISA ICS Advisory ICSA-25-105-04.
Detection Methods for CVE-2025-24315
Indicators of Compromise
- Unexpected devices appearing inside a user's scenes within the Growatt Cloud Portal.
- Scene membership changes that do not correspond to legitimate user activity in account audit logs.
- Requests to scene-modification endpoints originating from IP addresses unrelated to the account owner.
Detection Strategies
- Review server-side application logs for scene-management API calls that lack a valid authenticated session identifier.
- Correlate device-to-scene binding events with the account holder's recent authenticated activity and geolocation.
- Alert on repeated scene-modification requests referencing device identifiers not linked to the requesting account.
Monitoring Recommendations
- Enable audit logging on all scene and device association endpoints and retain the logs for post-incident review.
- Monitor for high-volume enumeration of numeric device identifiers, which suggests brute-force discovery of victim devices.
- Track anomalies in device grouping activity per account and flag deviations from historical baselines.
How to Mitigate CVE-2025-24315
Immediate Actions Required
- Review scene configurations in the Growatt Cloud Portal and remove any devices that do not belong to the account.
- Contact Growatt support to confirm that remediation has been applied to the affected cloud endpoints.
- Audit account activity for unauthorized changes and reset any credentials that may have been exposed during triage.
Patch Information
CVE-2025-24315 affects a vendor-operated cloud service, so remediation is applied server-side by Growatt rather than through a customer-installed patch. Refer to CISA ICS Advisory ICSA-25-105-04 for the current remediation status and vendor guidance.
Workarounds
- Regularly inspect scene membership in the Growatt Cloud Portal and remove unrecognized devices.
- Limit exposure of device serial numbers and identifiers, which serve as the user-controlled keys abused by this flaw.
- Restrict operational reliance on scene-based automation until the vendor confirms the authorization check is enforced.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
