CVE-2025-27575: Growatt Cloud Portal Info Disclosure Flaw

CVE-2025-27575 Overview

CVE-2025-27575 is an information disclosure vulnerability affecting the Growatt Cloud Portal. An unauthenticated attacker who knows a valid electric vehicle (EV) charger ID can retrieve the charger's version details and firmware upgrade history from the cloud service. The issue stems from an authorization weakness classified under [CWE-639] Authorization Bypass Through User-Controlled Key. Exploitation requires only network access to the portal and knowledge of a charger identifier, which is often predictable or exposed on device labels.

Critical Impact
Unauthenticated remote attackers can enumerate EV charger firmware versions and upgrade histories, enabling reconnaissance for targeted follow-on attacks against outdated devices.

Affected Products

Growatt Cloud Portal (all versions prior to vendor remediation)
EV chargers managed through the Growatt Cloud Portal
Growatt cloud-connected charging infrastructure

Discovery Timeline

2025-04-15 - CVE-2025-27575 published to the National Vulnerability Database (NVD)
2025-04-15 - CISA issues ICS Advisory ICSA-25-105-04
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27575

Vulnerability Analysis

The Growatt Cloud Portal exposes an endpoint that returns firmware metadata for EV chargers based solely on a supplied charger ID. The service does not verify whether the requester owns or has been granted access to the queried device. Any network-connected client can query the API and receive firmware version strings and historical upgrade records. This information supports adversary reconnaissance and helps attackers identify chargers running vulnerable firmware.

Root Cause

The vulnerability is a broken object-level authorization flaw ([CWE-639]). The application treats the charger ID as an implicit access token rather than validating an authenticated session against the device ownership record. Because the ID is used as the sole selector for data retrieval, the missing authorization check allows anyone to enumerate device metadata by iterating or guessing IDs.

Attack Vector

An attacker interacts with the Growatt Cloud Portal over the network without credentials. The attacker supplies a valid charger ID in an API request and receives firmware version and upgrade history in the response. Charger IDs may be obtained through physical inspection of devices, leaked documentation, or automated enumeration. No user interaction or elevated privileges are required, and the flaw impacts confidentiality without directly affecting integrity or availability.

Refer to the CISA ICS Advisory ICSA-25-105-04 for vendor-provided technical details.

Detection Methods for CVE-2025-27575

Indicators of Compromise

Unauthenticated HTTP/HTTPS requests to Growatt Cloud Portal endpoints referencing charger IDs from unfamiliar source addresses.
High-volume sequential or dictionary-style requests targeting charger ID parameters, indicating enumeration attempts.
Anomalous geographic or ASN patterns in requests to the portal's firmware or version-related endpoints.

Detection Strategies

Review cloud portal access logs for repeated requests to firmware metadata endpoints without authenticated sessions.
Correlate charger ID request patterns against known-good client sources to surface unauthorized queries.
Alert on responses that return firmware version or upgrade history payloads to unauthenticated clients.

Monitoring Recommendations

Ingest Growatt Cloud Portal access logs into a centralized SIEM or data lake for continuous analysis.
Establish a baseline for normal charger ID query rates and alert on statistical deviations.
Monitor threat intelligence feeds for reports of Growatt charger ID lists or leaked device inventories.

How to Mitigate CVE-2025-27575

Immediate Actions Required

Contact Growatt support to confirm that server-side authorization checks have been applied to your tenant.
Restrict outbound exposure of charger IDs by removing them from public documentation, invoices, and marketing collateral.
Rotate or reissue charger IDs where the vendor supports this option, particularly for high-value or publicly identifiable installations.
Enable multi-factor authentication (MFA) on all Growatt Cloud Portal user accounts to limit lateral impact of reconnaissance.

Patch Information

Remediation for CVE-2025-27575 is applied server-side by Growatt within the Cloud Portal. Operators do not need to update on-device firmware to receive the authorization fix. Consult the CISA ICS Advisory ICSA-25-105-04 and Growatt support channels for the current remediation status and any customer-specific actions.

Workarounds

Treat charger IDs as sensitive identifiers and avoid disclosing them in support tickets, screenshots, or third-party integrations.
Place network monitoring in front of any on-premises components that interact with the Growatt Cloud Portal to detect enumeration.
Inventory all Growatt EV chargers and record firmware versions offline so that operators can validate portal responses against a trusted source.

bash

# Example: log-review query to surface unauthenticated firmware metadata requests
grep -E "/charger/(version|firmware|upgrade)" access.log \
  | awk '$9 == 200 && $0 !~ /Authorization:/' \
  | awk '{print $1}' | sort | uniq -c | sort -rn | head -20