CVE-2025-30254 Overview
CVE-2025-30254 affects the Growatt Cloud Portal, a cloud management platform for solar energy and smart metering deployments. An unauthenticated attacker can retrieve the serial number of a smart meter by supplying the owner's username to an exposed portal endpoint. The vulnerability is classified as an Insecure Direct Object Reference issue under CWE-639 (Authorization Bypass Through User-Controlled Key). The flaw was disclosed publicly through CISA ICS Advisory ICSA-25-105-04.
Critical Impact
Attackers can enumerate smart meter serial numbers tied to specific account holders without authentication, enabling downstream targeting of individual devices and their owners.
Affected Products
- Growatt Cloud Portal (all versions listed in ICSA-25-105-04)
- Deployments exposing the affected API endpoint to the public internet
- Smart meters and connected devices registered under Growatt user accounts
Discovery Timeline
- 2025-04-15 - CVE-2025-30254 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30254
Vulnerability Analysis
The Growatt Cloud Portal exposes functionality that accepts a username as an input parameter and returns device identifiers associated with that account. The endpoint does not require authentication or a valid session before returning meter data. As a result, any remote party who knows or guesses a valid username can request the serial numbers of that user's smart meters.
Serial numbers are not intended to be public identifiers in Growatt's ecosystem. They are commonly used as device references in follow-on API calls, pairing workflows, and support processes. Disclosure of these values expands the attack surface against downstream device management interfaces and can support account or device impersonation attempts.
Root Cause
The underlying defect is a missing authorization check on a user-controlled lookup key, tracked under CWE-639. The portal treats the username as a sufficient reference to return sensitive device metadata, rather than enforcing that the caller is authenticated and authorized to view records for that user. This is a classic Insecure Direct Object Reference pattern in a cloud-managed IoT service.
Attack Vector
Exploitation requires only network access to the portal, no privileges, and no user interaction. An attacker submits a request containing a target username to the affected endpoint and receives the associated meter serial numbers in the response. Usernames can be harvested from public sources, social media, breach corpora, or enumerated using common naming patterns.
No verified proof-of-concept code is published for this issue. Refer to CISA ICS Advisory ICSA-25-105-04 for vendor-supplied technical details.
Detection Methods for CVE-2025-30254
Indicators of Compromise
- High volumes of unauthenticated requests to Growatt Cloud Portal endpoints that accept a username parameter.
- Repeated portal requests from a single source iterating through different usernames within short time windows.
- Portal responses containing meter serial numbers returned to clients without an authenticated session token.
Detection Strategies
- Review web access logs and API gateway logs for enumeration patterns against user-lookup endpoints on the Growatt Cloud Portal.
- Alert on requests to affected endpoints that lack authentication headers or session cookies yet return non-empty device data.
- Correlate portal query patterns with known threat intelligence feeds covering scraping infrastructure and residential proxies.
Monitoring Recommendations
- Track baseline request rates per source IP and per user account to detect enumeration bursts.
- Monitor for anomalous geographic distribution of portal queries against known customer account locations.
- Ingest Growatt Cloud Portal telemetry into a centralized SIEM or data lake for correlation with other IoT and identity events.
How to Mitigate CVE-2025-30254
Immediate Actions Required
- Follow the guidance in CISA ICS Advisory ICSA-25-105-04 and confirm remediation status with Growatt support.
- Rotate usernames or account identifiers for high-value deployments where feasible, and treat previously exposed serial numbers as known to adversaries.
- Restrict portal exposure to trusted networks where operational requirements allow.
Patch Information
CISA coordinated disclosure through advisory ICSA-25-105-04. Consult the CISA ICS Advisory and Growatt's customer communications for the authoritative list of fixed portal versions and any required user-side actions. Because the vulnerability resides in the cloud portal, fixes are applied server-side by the vendor rather than through customer-installed updates.
Workarounds
- Avoid using easily guessable usernames such as email prefixes, personal names, or company names when creating Growatt Cloud Portal accounts.
- Place portal access behind network controls such as VPNs or IP allow lists when the deployment architecture supports it.
- Review and remove any integrations or scripts that expose Growatt usernames in public documentation, mobile app metadata, or third-party services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
