CVE-2025-24850 Overview
CVE-2025-24850 affects the Growatt Cloud Portal, a cloud management platform for solar photovoltaic (PV) systems. The vulnerability allows an unauthenticated remote attacker to export plant information belonging to other users. The flaw is classified as an Authorization Bypass Through User-Controlled Key issue [CWE-639], commonly referred to as Insecure Direct Object Reference (IDOR).
CISA published this issue in ICS Advisory ICSA-25-105-04, highlighting risk exposure to renewable energy operators using Growatt's cloud services.
Critical Impact
Remote attackers can enumerate and exfiltrate solar plant records belonging to other tenants without authentication, exposing operational data across Growatt Cloud Portal customers.
Affected Products
- Growatt Cloud Portal (all versions prior to vendor remediation)
- Web-facing tenants of the Growatt cloud management service
- Downstream integrations relying on Growatt plant APIs
Discovery Timeline
- 2025-04-15 - CVE-2025-24850 published to NVD
- 2025-04-15 - CISA publishes ICS Advisory ICSA-25-105-04
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24850
Vulnerability Analysis
The Growatt Cloud Portal exposes plant export functionality that references user-owned resources by identifier. The application accepts these identifiers from the client without verifying that the requesting session owns the referenced plant. As a result, an attacker can substitute another user's plant identifier and receive the associated data in the export response.
The issue maps to [CWE-639]: Authorization Bypass Through User-Controlled Key. Attack complexity is low, no privileges are required, and no user interaction is needed. The EPSS score is 0.346%.
Exposed plant information can include site names, geographic location, installed capacity, device inventories, and generation telemetry. This data supports reconnaissance against solar installations and their operators.
Root Cause
The root cause is missing object-level authorization on the plant export endpoint. The server trusts the plant identifier supplied in the request instead of validating ownership against the authenticated session context.
Attack Vector
The attack vector is network-based over the public Growatt Cloud Portal interface. An attacker submits requests to the plant export endpoint and iterates through predictable or enumerated identifiers to harvest records belonging to other customers.
No exploitation code is publicly available. The vulnerability is described in prose by CISA; see the CISA ICS Advisory ICSA-25-105-04 for the vendor-coordinated details.
Detection Methods for CVE-2025-24850
Indicators of Compromise
- Unusual volumes of plant export requests from a single source IP or account.
- Sequential or randomized enumeration of plant identifiers in application logs.
- Export responses returning plant records not associated with the requesting account.
- Access to the Growatt Cloud Portal from geographies inconsistent with the account owner.
Detection Strategies
- Correlate authenticated session identifiers with the ownership of returned plant records at the API gateway or web application firewall (WAF).
- Alert on anomalous export API request rates and repeated 200-response patterns against plant endpoints.
- Baseline normal export activity per account and flag deviations that resemble enumeration.
Monitoring Recommendations
- Ingest Growatt Cloud Portal access logs and API telemetry into a centralized SIEM for correlation.
- Track outbound data volumes from export endpoints and alert on spikes.
- Monitor for repeated requests carrying incrementing numeric identifiers indicative of IDOR probing.
How to Mitigate CVE-2025-24850
Immediate Actions Required
- Contact Growatt support to confirm that your tenant is running a remediated version of the Cloud Portal.
- Review recent plant export activity for accounts under your control and investigate anomalous requests.
- Restrict access to the Growatt Cloud Portal to known corporate IP ranges where feasible.
- Rotate API tokens and session credentials associated with Growatt integrations.
Patch Information
Growatt addressed the issue in the Cloud Portal service. Because the platform is vendor-hosted, remediation is deployed centrally by Growatt. Refer to CISA ICS Advisory ICSA-25-105-04 for coordinated vendor guidance and confirm remediation status directly with Growatt.
Workarounds
- Enforce upstream access controls on the Growatt Cloud Portal using an identity-aware proxy or VPN.
- Apply WAF rules to rate-limit and inspect plant export API traffic.
- Disable unused Growatt Cloud Portal accounts to reduce the attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
