CVE-2025-27927: Growatt Cloud Portal Info Disclosure Flaw

CVE-2025-27927 Overview

CVE-2025-27927 is an authorization flaw in the Growatt Cloud Portal. Unauthenticated attackers can query an unprotected API endpoint and retrieve the list of smart devices tied to a known username. The weakness is classified as [CWE-639]: Authorization Bypass Through User-Controlled Key. Because the API does not validate the requester's identity, any actor who guesses or harvests a valid username can enumerate that user's connected devices. This exposure impacts confidentiality of solar inverter and IoT device inventories managed through the portal.

Critical Impact
Remote, unauthenticated attackers can enumerate smart devices linked to any Growatt Cloud Portal account by supplying a valid username, exposing device inventories used for downstream targeting.

Affected Products

Growatt Cloud Portal (web application)
Growatt-managed smart device accounts referenced by username
Deployments listed in CISA ICS Advisory ICSA-25-105-04

Discovery Timeline

2025-04-15 - CVE-2025-27927 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27927

Vulnerability Analysis

The Growatt Cloud Portal exposes an API endpoint that returns the smart devices associated with a given username. The endpoint accepts the username as a user-controlled key without enforcing authentication or session-based authorization. An attacker who knows or guesses a valid username receives the corresponding device list in the response. This is a canonical [CWE-639] authorization bypass, where access decisions rely on client-supplied identifiers rather than validated credentials. The vulnerability affects the confidentiality of device inventory data. It does not directly modify device state or affect availability, but the exposed inventory supports reconnaissance for follow-on attacks against solar inverters and connected IoT hardware. The EPSS probability is 0.293% with a percentile of 21.379, indicating limited observed exploitation activity to date.

Root Cause

The root cause is missing authorization enforcement on an API route that accepts a username parameter. The backend trusts the supplied identifier and returns associated device records without verifying that the caller owns the account or holds a valid session token.

Attack Vector

An attacker sends an HTTP request to the vulnerable API endpoint with a target username. No credentials, tokens, or user interaction are required. Usernames can be sourced from public disclosures, phishing telemetry, breach corpora, or predictable naming conventions. The response reveals the smart devices registered under that account.

No verified public proof-of-concept code is available. Refer to CISA ICS Advisory ICSA-25-105-04 for coordinated technical details.

Detection Methods for CVE-2025-27927

Indicators of Compromise

Unauthenticated HTTP requests to Growatt Cloud Portal API endpoints containing a username query or path parameter
High-volume enumeration patterns iterating through candidate usernames from a single source IP or ASN
API responses returning device inventory JSON without a preceding authentication exchange

Detection Strategies

Inspect web server and API gateway logs for requests to device-listing endpoints that lack an Authorization header or valid session cookie
Correlate repeated 200 OK responses to device enumeration endpoints against distinct username values within short time windows
Alert on user-agent strings and IP addresses that access the portal API without corresponding successful login events

Monitoring Recommendations

Forward Growatt Cloud Portal access logs to a centralized SIEM for baseline and anomaly analysis
Track per-source request rates against device inventory APIs and flag deviations from normal user behavior
Monitor threat intelligence feeds for leaked Growatt username lists that could accelerate enumeration attempts

How to Mitigate CVE-2025-27927

Immediate Actions Required

Review the CISA ICS Advisory ICSA-25-105-04 and apply vendor guidance published by Growatt
Restrict external exposure of the Growatt Cloud Portal API where operationally feasible
Rotate any usernames or account identifiers that follow predictable patterns and enforce non-trivial account naming

Patch Information

Growatt Cloud Portal is a vendor-hosted service. Remediation is applied server-side by Growatt. Consult CISA ICS Advisory ICSA-25-105-04 for the current fix status and any customer-side configuration steps.

Workarounds

Place the portal behind an authenticated reverse proxy or IP allowlist for administrative access where deployment allows
Enable web application firewall rules to rate-limit and inspect unauthenticated requests to device-listing endpoints
Treat portal usernames as sensitive and avoid publishing them in support tickets, community forums, or public asset inventories

bash

# Example WAF rate-limit rule (illustrative)
# Limit unauthenticated requests to device inventory endpoints
limit_req_zone $binary_remote_addr zone=growatt_api:10m rate=5r/m;

location /api/device/list {
    limit_req zone=growatt_api burst=3 nodelay;
    if ($http_authorization = "") {
        return 401;
    }
}