CVE-2025-27561: Growatt Cloud Portal Auth Bypass Flaw

CVE-2025-27561 Overview

CVE-2025-27561 is an authorization flaw in the Growatt Cloud Portal that allows unauthenticated attackers to rename "rooms" belonging to arbitrary users. The vulnerability is classified under [CWE-639] Authorization Bypass Through User-Controlled Key, indicating that the application relies on client-supplied identifiers without verifying ownership. Growatt Cloud Portal is a cloud-based management interface for solar photovoltaic (PV) equipment, and "rooms" represent logical groupings of user-owned devices. CISA documented the issue in ICS advisory ICSA-25-105-04 covering multiple Growatt web platform weaknesses.

Critical Impact
Remote unauthenticated attackers can modify the room names of any Growatt Cloud Portal user, tampering with device organization data without credentials or user interaction.

Affected Products

Growatt Cloud Portal (cloud-hosted service)
Deployments referenced in CISA advisory ICSA-25-105-04
Users managing PV inverters and related devices through the portal

Discovery Timeline

2025-04-15 - CVE-2025-27561 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27561

Vulnerability Analysis

The vulnerability resides in a Growatt Cloud Portal API endpoint responsible for renaming user-defined "rooms." The endpoint accepts a room identifier and a new name from the request but fails to validate that the caller owns the referenced room. The endpoint is also reachable without authentication, meaning no session token or credential check gates the operation. An attacker can enumerate or guess room identifiers and issue rename requests that the backend applies against records owned by other users. While the change is limited to a display attribute rather than device control, it corrupts the integrity of user-managed organization data across the tenant base.

Root Cause

The root cause is a missing authorization check at the object level, consistent with [CWE-639] Insecure Direct Object Reference. The API trusts the object identifier supplied by the client and does not correlate the target roomId to the requesting principal. Compounding the issue, the endpoint accepts anonymous requests, removing the authentication perimeter that would otherwise limit exposure.

Attack Vector

Exploitation requires only network access to the Growatt Cloud Portal API. An attacker sends an HTTP request to the room-rename endpoint containing a target room identifier and an attacker-chosen name. Because the service does not require credentials or verify ownership, the backend commits the rename. No user interaction is required on the victim's side. Details on the vulnerable endpoint are described in the CISA ICS Advisory ICSA-25-105-04. No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-27561

Indicators of Compromise

Unexpected changes to "room" names within a Growatt Cloud Portal user account
Portal audit log entries showing rename actions without a corresponding user session
User support tickets referencing unfamiliar or offensive labels on device groupings

Detection Strategies

Review server-side API logs for calls to the room-rename endpoint that lack an authenticated session identifier
Correlate room-rename events with the source IP to identify high-volume or scripted enumeration
Alert on rename operations where the acting user identifier does not match the room owner

Monitoring Recommendations

Enable verbose logging on all portal API endpoints that mutate user-owned objects
Retain access logs long enough to support forensic review after CISA-referenced Growatt advisories
Notify affected account holders when a rename event occurs from an anonymous or unrecognized session

How to Mitigate CVE-2025-27561

Immediate Actions Required

Review Growatt Cloud Portal accounts for unauthorized changes to room names and restore expected values
Restrict administrative and API access to the portal from untrusted networks where feasible
Follow the guidance published in the CISA ICS Advisory ICSA-25-105-04

Patch Information

Growatt Cloud Portal is a vendor-operated cloud service, so remediation is applied server-side by Growatt rather than through a customer-installed patch. Customers should consult the CISA ICS Advisory ICSA-25-105-04 and Growatt communications to confirm the fix status for the room-rename endpoint. No customer-side software version is listed as fixed in the enriched data.

Workarounds

Monitor room names and device group labels for unexpected changes and revert them promptly
Limit disclosure of internal room and device identifiers in screenshots or shared content
Report suspected tampering to Growatt support and reference CVE-2025-27561

bash

# No customer-side configuration change remediates this cloud-service flaw.
# Contact the vendor and follow CISA ICSA-25-105-04 for remediation status.