CVE-2025-27568 Overview
CVE-2025-27568 is an information disclosure vulnerability in the Growatt Cloud Portal. An unauthenticated attacker can retrieve a user's email address by submitting a password reset request with a known username. The portal responds by sending a password reset email, effectively confirming account existence and exposing the associated email address.
The flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key. It affects the Growatt Cloud Portal used to manage solar and energy monitoring installations. CISA published advisory ICSA-25-105-04 covering this issue.
Critical Impact
Attackers can enumerate valid usernames and harvest associated email addresses without authentication, enabling targeted phishing and credential stuffing campaigns against Growatt customers.
Affected Products
- Growatt Cloud Portal (web application)
- Associated Growatt solar monitoring accounts
- Users of the Growatt ShinePhone and ShineServer ecosystem authenticated via the cloud portal
Discovery Timeline
- 2025-04-15 - CVE-2025-27568 published to the National Vulnerability Database
- 2025-04-15 - CISA publishes ICS advisory ICSA-25-105-04
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27568
Vulnerability Analysis
The Growatt Cloud Portal exposes a password reset endpoint that accepts a username as input. The endpoint does not require the requester to prove control of the account or complete any challenge before triggering downstream behavior. When an attacker submits a valid username, the portal generates and sends a password reset email to the associated address.
This behavior discloses two pieces of information to unauthenticated parties. First, it confirms that the submitted username exists in the Growatt user database. Second, it delivers a reset email that ties the username to an email account, and in some flows may reveal parts of the email in the response or error message. The unsolicited email itself also degrades trust in legitimate Growatt communications.
Because the vulnerability affects an internet-facing cloud service, exploitation is achievable at scale using automated tooling. Attackers can iterate through candidate usernames drawn from breach corpora, social media, or Growatt community forums.
Root Cause
The root cause is missing authorization and rate control on the password reset workflow. The portal treats the username parameter as sufficient input to trigger an account-linked action. There is no bot mitigation, no generic response for non-existent accounts, and no throttling that would prevent enumeration of the account namespace.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to the password reset endpoint with attacker-controlled usernames. The portal's response and the resulting email delivery confirm account existence. Repeated requests build a mapping of valid usernames to registered users.
No verified public exploit code is available. See the CISA ICS Advisory ICSA-25-105-04 for vendor coordination details.
Detection Methods for CVE-2025-27568
Indicators of Compromise
- Spikes in password reset requests from a small set of source IP addresses targeting the Growatt Cloud Portal
- Sequential or dictionary-style username values submitted to the reset endpoint
- User reports of unsolicited Growatt password reset emails received without initiating a reset
- Requests originating from cloud hosting providers or anonymizing proxies against /forgotPassword style endpoints
Detection Strategies
- Correlate web access logs on the password reset endpoint against a baseline of expected reset volume per hour
- Alert on any single client IP submitting more than a low threshold (for example, five) of distinct usernames within a short window
- Track high ratios of reset requests to successful logins as an enumeration signal
Monitoring Recommendations
- Forward Growatt Cloud Portal application logs to a central SIEM for retention and analytics
- Monitor outbound password reset email volume and flag deviations from the normal daily curve
- Collect user-reported unsolicited reset emails through a helpdesk workflow and feed them into detection rules
How to Mitigate CVE-2025-27568
Immediate Actions Required
- Review CISA ICS Advisory ICSA-25-105-04 and apply vendor guidance from Growatt
- Notify Growatt Cloud Portal users to expect and report any unsolicited password reset emails
- Enable multi-factor authentication on Growatt accounts where supported to limit downstream credential abuse
Patch Information
Growatt addressed this issue on the server side of its cloud portal. Because the flaw resides in the hosted service, customers do not install a client patch. Confirm remediation status with Growatt and review the CISA advisory for the current fix state.
Workarounds
- Rotate usernames that are guessable, publicly known, or derived from email addresses to reduce enumeration success
- Train users to treat unexpected password reset emails as potential targeting indicators and report them
- Restrict administrative access to the portal by source IP where the vendor supports IP allowlisting
- Use unique passwords per service so that any harvested email cannot be paired with reused credentials in downstream attacks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
