CVE-2025-27565 Overview
CVE-2025-27565 is an authorization flaw in the Growatt Cloud Portal. An unauthenticated remote attacker can delete any user's "rooms" by supplying the target user ID and room ID. The vulnerability maps to [CWE-639: Authorization Bypass Through User-Controlled Key], commonly known as an Insecure Direct Object Reference (IDOR).
The issue affects the Growatt Cloud Portal, a cloud service used to monitor and manage Growatt solar and energy storage devices. CISA published advisory ICSA-25-105-04 covering this and related Growatt issues.
Critical Impact
An unauthenticated attacker who knows or guesses a valid user ID and room ID can delete arbitrary rooms belonging to any user, disrupting device organization within the portal.
Affected Products
- Growatt Cloud Portal (cloud-hosted service)
- CPE: cpe:2.3:a:growatt:cloud_portal:*:*:*:*:*:*:*:*
- Component: growatt:cloud_portal
Discovery Timeline
- 2025-04-15 - CVE-2025-27565 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27565
Vulnerability Analysis
The Growatt Cloud Portal exposes an endpoint that deletes user-created "rooms," which are logical groupings used to organize devices in the portal. The endpoint accepts a user identifier and room identifier as request parameters but fails to authenticate the caller or verify that the caller owns the target room.
An attacker who knows or enumerates a target user ID and room ID can issue a delete request without any credentials. The server processes the request and removes the room from the target account. This weakness is categorized under [CWE-639] as an authorization bypass via user-controlled keys.
Root Cause
The root cause is missing authorization on a state-changing API operation. The delete function trusts client-supplied identifiers instead of validating the session context against the resource owner. Because the endpoint also lacks authentication, any network attacker can reach it directly.
Attack Vector
Exploitation requires only network access to the Growatt Cloud Portal API. The attacker crafts an HTTP request containing a valid user ID and room ID for the target account. User IDs and room IDs may be enumerable or leaked through other portal features, lowering the barrier to targeting specific accounts. No user interaction, privileges, or authentication is required.
No public proof-of-concept or exploit code is listed for this CVE. See the CISA ICS Advisory ICSA-25-105-04 for vendor-coordinated details.
Detection Methods for CVE-2025-27565
Indicators of Compromise
- Unexpected disappearance of "rooms" in the Growatt Cloud Portal for one or more user accounts.
- Portal audit log entries showing room deletion events without a corresponding authenticated user session.
- Bursts of API requests to room management endpoints originating from unfamiliar IP addresses or user agents.
Detection Strategies
- Review Growatt Cloud Portal audit logs for room deletion events and correlate them against legitimate user activity.
- Alert on any state-changing API call to room management endpoints that lacks an authenticated session identifier.
- Track anomalous enumeration patterns against user ID or room ID parameters, such as sequential or high-volume access.
Monitoring Recommendations
- Enable and retain application-layer logging for all Growatt Cloud Portal API calls, including source IP, parameters, and outcome.
- Establish a baseline of expected room create and delete volume per tenant to detect deviations.
- Notify affected users when a room is deleted so they can flag unauthorized changes quickly.
How to Mitigate CVE-2025-27565
Immediate Actions Required
- Contact Growatt support to confirm remediation status for your account and request audit log exports covering room management activity.
- Inventory rooms and device groupings in the portal and document the expected state so unauthorized deletions can be identified and restored.
- Restrict portal access to trusted networks where feasible and enforce strong authentication on all portal user accounts.
Patch Information
The vulnerability affects the Growatt Cloud Portal, a vendor-operated cloud service. Remediation is applied server-side by Growatt rather than through a customer-installed patch. Refer to CISA ICS Advisory ICSA-25-105-04 for the coordinated vendor response and current mitigation guidance.
Workarounds
- Reduce exposure by limiting the number of users and devices linked to a single portal account until vendor confirmation of the fix.
- Periodically export or snapshot device and room configuration so any unauthorized deletion can be reconstructed.
- Where supported, use portal features that require additional verification for destructive actions and review account activity regularly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
