CVE-2025-26857 Overview
CVE-2025-26857 is an authorization bypass vulnerability in the Growatt Cloud Portal. Unauthenticated attackers can rename arbitrary devices belonging to arbitrary users, including electric vehicle (EV) chargers and other connected solar equipment. The flaw stems from an Insecure Direct Object Reference (IDOR) condition classified under [CWE-639]. Because the portal manages energy infrastructure across residential and commercial deployments, attackers can manipulate device identifiers without any prior authentication. The vulnerability is tracked in CISA ICS Advisory ICSA-25-105-04.
Critical Impact
Unauthenticated network attackers can rename any user's Growatt-connected device, enabling operational confusion, targeted social engineering, and disruption of EV charging and solar monitoring workflows.
Affected Products
- Growatt Cloud Portal (all versions prior to vendor remediation)
- Growatt-connected EV chargers managed through the cloud portal
- Growatt solar monitoring devices registered to the portal
Discovery Timeline
- 2025-04-15 - CVE-2025-26857 published to the National Vulnerability Database
- 2025-04-15 - CISA publishes ICS Advisory ICSA-25-105-04
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26857
Vulnerability Analysis
The Growatt Cloud Portal exposes a device-rename function that accepts a device identifier as user-controlled input. The endpoint fails to verify that the requester is authenticated or that the requester owns the referenced device. An attacker submits a rename request referencing another user's device identifier and the portal accepts the change. This maps directly to [CWE-639]: Authorization Bypass Through User-Controlled Key. The EPSS probability for this CVE is 0.299% (22.1 percentile), indicating limited public exploitation activity at the time of publication.
Root Cause
The rename operation trusts client-supplied device identifiers without server-side session validation or ownership checks. Access control decisions rely on the presence of the identifier rather than a binding between the authenticated session and the device record. As a result, the portal treats any request with a valid device ID as authorized.
Attack Vector
Exploitation occurs entirely over the network with no authentication, no user interaction, and low attack complexity. An attacker enumerates or guesses device identifiers and issues rename requests directly to the portal's device management API. Successful requests overwrite the display name of the targeted device across the victim's dashboards and notifications. No verified proof-of-concept code has been published. See the CISA ICS Advisory for technical details.
Detection Methods for CVE-2025-26857
Indicators of Compromise
- Unexpected changes to device display names in Growatt Cloud Portal dashboards or notification emails.
- Rename API requests originating from IP addresses that do not match the account owner's typical geography.
- Bursts of sequential or enumerated device identifiers appearing in portal access logs.
Detection Strategies
- Correlate device-rename events in Growatt portal audit logs with the authenticated session identity that initiated them.
- Alert on rename requests that lack a valid authenticated session cookie or bearer token.
- Baseline the normal rate of device-rename operations per tenant and flag statistical outliers.
Monitoring Recommendations
- Forward Growatt Cloud Portal access and audit logs to a centralized SIEM for retention and analysis.
- Monitor outbound and inbound API traffic to Growatt portal endpoints from customer networks.
- Review device inventory names on a scheduled cadence to detect silent modifications.
How to Mitigate CVE-2025-26857
Immediate Actions Required
- Contact Growatt support to confirm your tenant is running a remediated version of the Cloud Portal.
- Audit all managed devices for unexpected name changes and restore correct labels.
- Restrict portal access to trusted networks where feasible, using VPN or IP allow-listing.
- Enable multi-factor authentication on all Growatt Cloud Portal accounts to limit downstream account abuse.
Patch Information
Remediation is delivered by Growatt as a server-side update to the Cloud Portal. Customers do not apply a client patch; the fix is deployed by the vendor. Refer to CISA ICS Advisory ICSA-25-105-04 for the current vendor response and coordination status.
Workarounds
- Regularly export and back up device inventory data so that unauthorized renames can be reversed quickly.
- Subscribe to portal notification channels that alert on device configuration changes.
- Segment EV charger and inverter management networks from general internet-exposed systems.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
