CVE-2025-27719 Overview
CVE-2025-27719 is an authorization flaw in the Growatt Cloud Portal. Unauthenticated attackers can query an exposed API endpoint and retrieve device details without providing credentials. The issue is tracked under [CWE-639] Authorization Bypass Through User-Controlled Key, an Insecure Direct Object Reference (IDOR) pattern. CISA published advisory ICSA-25-105-04 covering the affected Growatt cloud infrastructure used to manage solar inverters and related energy devices. The vulnerability requires no privileges, no user interaction, and is exploitable over the network. Confidentiality of device metadata is impacted, while integrity and availability are not directly affected.
Critical Impact
Remote unauthenticated attackers can enumerate Growatt Cloud Portal device details through an API endpoint that fails to enforce authorization checks.
Affected Products
- Growatt Cloud Portal (all versions prior to the vendor fix as referenced in CISA advisory ICSA-25-105-04)
Discovery Timeline
- 2025-04-15 - CVE-2025-27719 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27719
Vulnerability Analysis
The Growatt Cloud Portal exposes an API endpoint that returns device details when queried. The endpoint does not validate that the requester is authenticated or authorized to view the referenced device. An attacker who supplies a valid device identifier receives back device metadata associated with that identifier. Because the identifier is user-controlled and the server does not tie it to a session or ownership check, the flaw meets the definition of Authorization Bypass Through User-Controlled Key ([CWE-639]).
Exploitation is trivial from the network. An attacker issues HTTP requests against the vulnerable endpoint with enumerated or guessed device identifiers. Each successful request returns device details for the corresponding cloud-managed asset. Solar photovoltaic installations, inverters, and related smart energy devices registered on the platform fall within the disclosure scope.
The impact is limited to information disclosure of device data. The vulnerability does not by itself grant control of devices or modification of device state. However, disclosed device details can support reconnaissance for follow-on attacks against the same fleet, including targeting of related Growatt endpoints tracked in ICSA-25-105-04.
Root Cause
The root cause is missing server-side authorization on an API route. The endpoint accepts a device identifier from the client and returns matching records without verifying that the caller owns the device or holds a valid session token.
Attack Vector
The attack vector is network-based over the public Growatt Cloud Portal API. No credentials, tokens, or user interaction are required. See the CISA ICS Advisory ICSA-25-105-04 for the full technical description.
Detection Methods for CVE-2025-27719
Indicators of Compromise
- High-volume sequential or enumerated requests to Growatt Cloud Portal API endpoints returning device metadata
- Requests to device-detail API paths originating from IP addresses not associated with legitimate portal users or mobile app clients
- HTTP 200 responses for device queries where no session cookie or authorization header is present
Detection Strategies
- Review Growatt Cloud Portal access logs for unauthenticated requests to device-detail endpoints and correlate against known-good client identifiers
- Alert on request patterns that iterate through device identifier ranges within short time windows, which indicates enumeration
- Compare API request source IPs against threat intelligence feeds for scanning infrastructure
Monitoring Recommendations
- Enable full request logging on all cloud portal API endpoints, including source IP, path, query parameters, and authorization state
- Deploy rate limiting on device-detail endpoints and generate alerts when thresholds are exceeded
- Forward API gateway logs to a centralized analytics platform for anomaly detection on unauthenticated access patterns
How to Mitigate CVE-2025-27719
Immediate Actions Required
- Apply the fix referenced in CISA ICS Advisory ICSA-25-105-04 as soon as it is available from Growatt
- Restrict access to the Growatt Cloud Portal API from untrusted networks where feasible using upstream network controls
- Audit historical access logs for signs of prior device enumeration
Patch Information
Growatt addressed the reported issues through server-side changes to its cloud platform. Because the Growatt Cloud Portal is a vendor-hosted service, remediation is delivered by Growatt rather than by customer-side patching. Refer to CISA ICS Advisory ICSA-25-105-04 for confirmation of the fix status.
Workarounds
- No customer-deployable workaround exists for a vendor-hosted API; rely on Growatt to enforce authorization server-side
- Where possible, limit exposure of device identifiers in client-side code, mobile applications, and shared installer documentation
- Rotate any device identifiers that were publicly exposed if the vendor supports re-registration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
