CVE-2025-25276: Growatt Cloud Portal Auth Bypass Issue

CVE-2025-25276 Overview

CVE-2025-25276 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Growatt Cloud Portal. An unauthenticated attacker can hijack devices belonging to other users and potentially assume control over them. The flaw affects solar inverter and energy management systems that rely on the Growatt cloud service for remote monitoring and configuration. CISA published advisory ICSA-25-105-04 covering this issue and related Growatt vulnerabilities.

Critical Impact
Remote unauthenticated attackers can take over other users' connected solar and energy devices through the Growatt Cloud Portal, impacting device integrity across the customer base.

Affected Products

Growatt Cloud Portal (all versions prior to vendor fix)
Growatt solar inverters managed through the cloud portal
Growatt energy monitoring devices linked to affected accounts

Discovery Timeline

2025-04-15 - CVE-2025-25276 published to the National Vulnerability Database
2025-04-15 - CISA released ICS advisory ICSA-25-105-04
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25276

Vulnerability Analysis

The Growatt Cloud Portal exposes device identifiers or account references through API endpoints without validating that the requesting user owns the target resource. An attacker can iterate through or supply device identifiers belonging to other customers and receive control over those devices. The issue is classified under CWE-639, Authorization Bypass Through User-Controlled Key, and requires no authentication or user interaction to exploit.

Because the portal manages solar inverters and connected energy hardware, hijacking a device can alter operational parameters, disrupt power generation, or expose customer telemetry. The attack is delivered over the network against internet-facing cloud services, which broadens the potential victim pool beyond any single deployment. EPSS currently reports the probability of exploitation in the wild at 0.299%.

Root Cause

The root cause is missing server-side authorization checks on device-scoped operations. The backend trusts client-supplied object identifiers without confirming ownership against the authenticated session, allowing horizontal privilege escalation across tenants.

Attack Vector

An attacker sends crafted HTTP requests to the Growatt Cloud Portal referencing device identifiers associated with other accounts. Because the endpoints omit ownership checks, the portal executes the requested action on the victim's device. No credentials, elevated privileges, or user interaction are required.

No verified public proof-of-concept code is available. See the CISA ICS Advisory ICSA-25-105-04 for vendor-supplied technical context.

Detection Methods for CVE-2025-25276

Indicators of Compromise

Unexpected configuration changes on Growatt devices reported by legitimate account owners
Device control or telemetry actions originating from IP addresses outside the customer's normal geography
Cloud portal API requests referencing device IDs that do not correspond to the authenticated session
Sudden loss of visibility or ownership changes on registered inverters

Detection Strategies

Correlate cloud portal audit logs with device-side event logs to identify actions not initiated by the account owner
Alert on high rates of sequential or enumerated device ID access from a single source
Monitor for API responses that reveal cross-tenant device metadata

Monitoring Recommendations

Enable and centralize logging from the Growatt Cloud Portal and downstream inverters where supported
Track authentication and authorization anomalies at the cloud API layer
Review account activity for unexpected device registration, deregistration, or configuration writes

How to Mitigate CVE-2025-25276

Immediate Actions Required

Review Growatt account activity for unauthorized configuration or ownership changes
Rotate portal credentials and enforce multi-factor authentication where available
Restrict inverter management interfaces to trusted networks where operationally feasible
Follow guidance in CISA ICS Advisory ICSA-25-105-04

Patch Information

Growatt addresses this vulnerability at the cloud service layer. Because the Cloud Portal is vendor-hosted, remediation is applied server-side and does not require customer-installed patches. Confirm remediation status directly with Growatt and review CISA advisory ICSA-25-105-04 for the latest vendor coordination details.

Workarounds

Disable remote management features on devices when not required for operations
Segment inverter networks and limit outbound connectivity to only required Growatt endpoints
Audit registered devices in the Growatt Cloud Portal and remove any that are unrecognized

bash

# Example: restrict outbound access from inverter network to Growatt endpoints only
iptables -A OUTPUT -o eth0 -d <growatt-endpoint-ip> -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -j DROP