CVE-2025-27929: Growatt Cloud Portal Info Disclosure Flaw

CVE-2025-27929 Overview

CVE-2025-27929 is an information disclosure vulnerability in the Growatt Cloud Portal, a cloud-based management platform for solar energy systems. Unauthenticated attackers can retrieve the full list of users associated with arbitrary accounts by manipulating account identifiers in API requests. The flaw stems from missing authorization checks on user enumeration endpoints, categorized as Authorization Bypass Through User-Controlled Key [CWE-639]. CISA published this issue in ICS Advisory ICSA-25-105-04, given the platform's role in critical energy infrastructure.

Critical Impact
Remote, unauthenticated attackers can enumerate account membership across the Growatt Cloud Portal without any user interaction, exposing user identifiers useful for downstream phishing, credential stuffing, and targeted attacks on solar energy operators.

Affected Products

Growatt Cloud Portal (cloud-hosted service)
Web and API interfaces exposed to the internet
Customer accounts managing photovoltaic installations through the portal

Discovery Timeline

2025-04-15 - CVE-2025-27929 published to NVD
2025-04-15 - CISA ICS Advisory ICSA-25-105-04 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27929

Vulnerability Analysis

The Growatt Cloud Portal exposes API endpoints that return user lists tied to specific account identifiers. These endpoints do not verify whether the requester is authenticated or authorized to view the target account. An attacker can iterate through account identifiers and harvest the users associated with each one. The disclosed information includes usernames and account associations, which support reconnaissance for further attacks. Because the portal manages distributed energy resources, exposed user data can help adversaries target operators of solar installations.

Root Cause

The root cause is an Insecure Direct Object Reference [CWE-639]. Server-side handlers accept account identifiers directly from client requests and return associated user records without validating the caller's session or entitlement to the requested account. Authorization is effectively absent on the affected endpoints.

Attack Vector

Exploitation requires only network access to the Growatt Cloud Portal. An attacker sends HTTP requests to the vulnerable API endpoints, substituting account identifiers to enumerate users. No credentials, tokens, or user interaction are required. See the CISA ICS Advisory ICSA-25-105-04 for vendor-confirmed details on the affected endpoints and impact.

No verified proof-of-concept code has been published. The vulnerability is described in prose because no sanitized exploitation artifact is available from authoritative sources.

Detection Methods for CVE-2025-27929

Indicators of Compromise

Repeated HTTP requests to Growatt Cloud Portal user or account API endpoints from a single source, iterating through numeric or sequential account identifiers.
Unauthenticated requests returning HTTP 200 responses containing user lists from portal API paths.
Bursts of traffic to the portal originating from cloud provider IP ranges, VPS hosts, or known scanning infrastructure.

Detection Strategies

Review Growatt Cloud Portal access logs for enumeration patterns such as sequential account ID access and high request volume without an authenticated session.
Correlate portal API traffic against threat intelligence feeds to identify sources performing account ID enumeration.
Baseline normal API request rates per source IP and alert on deviations that indicate scraping behavior.

Monitoring Recommendations

Forward web application firewall and API gateway logs to a centralized analytics platform for retention and query.
Alert on unauthenticated access to endpoints that should require a valid session token.
Track outbound communications from portal-connected devices for signs of follow-on phishing or credential-based attacks against enumerated users.

How to Mitigate CVE-2025-27929

Immediate Actions Required

Contact Growatt to confirm remediation status for your tenant and request confirmation that server-side authorization has been enforced on user enumeration endpoints.
Review the CISA ICS Advisory ICSA-25-105-04 for vendor guidance and current mitigation status.
Notify users associated with the portal to remain alert for phishing attempts referencing their Growatt accounts.

Patch Information

Growatt operates the Cloud Portal as a hosted service, so remediation is applied server-side by the vendor. No customer-installable patch is required. Refer to the CISA advisory for the authoritative status of vendor remediation.

Workarounds

Enforce strong, unique passwords and multi-factor authentication on all portal accounts to limit the value of leaked usernames.
Restrict portal access to known corporate IP ranges where the Growatt deployment supports source-based controls.
Monitor for phishing campaigns targeting enumerated users and provide user awareness training focused on Growatt-themed lures.

bash

# Example: monitor web/API traffic to Growatt Cloud Portal for enumeration
# Adjust the domain and log source paths to your environment
grep -E "server\.growatt\.com|openapi\.growatt\.com" /var/log/proxy/access.log \
  | awk '{print $1}' \
  | sort | uniq -c \
  | awk '$1 > 100 {print $0}'