CVE-2025-30512: Growatt Cloud Portal RCE Vulnerability

CVE-2025-30512 Overview

CVE-2025-30512 affects the Growatt Cloud Portal, a cloud management platform for solar photovoltaic (PV) monitoring and control. Unauthenticated attackers can send configuration settings to connected devices and potentially trigger physical actions such as turning devices on or off. The flaw is remotely exploitable over the network and requires no privileges or user interaction. CISA published advisory ICSA-25-105-04 addressing this and related Growatt Cloud Portal issues. The weakness is classified under CWE-15: External Control of System or Configuration Setting.

Critical Impact
Remote unauthenticated attackers can modify device configurations and toggle physical states of Growatt-connected solar equipment through the cloud portal.

Affected Products

Growatt Cloud Portal (all versions prior to the vendor-remediated release referenced in ICSA-25-105-04)
Solar PV devices managed through the Growatt Cloud Portal
Deployments exposing the affected cloud portal endpoints to the public internet

Discovery Timeline

2025-04-15 - CVE-2025-30512 published to the National Vulnerability Database
2025-04-15 - CISA publishes ICS advisory ICSA-25-105-04
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-30512

Vulnerability Analysis

The Growatt Cloud Portal exposes configuration endpoints that accept requests without validating the caller's identity. An attacker who can reach the portal over the network can submit configuration changes for devices they do not own. Because the portal relays these settings to physical solar equipment, the flaw crosses from the cloud plane into operational impact. Successful abuse can alter device parameters and trigger physical state transitions, including on and off actions.

Root Cause

The root cause is external control of system or configuration settings (CWE-15). The application does not enforce authentication or authorization checks before applying user-supplied configuration values. This design gap allows any network-reachable client to influence backend device state.

Attack Vector

Exploitation is network-based and requires no credentials. An attacker crafts HTTP requests to the affected cloud portal endpoints and submits configuration payloads targeting specific device identifiers. The portal accepts the request and forwards the settings to the target device. No exploit code is publicly available at the time of writing, and CVE-2025-30512 is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.616% (percentile 45.92) as of 2026-07-28.

No verified public proof-of-concept exists. See the CISA ICS Advisory ICSA-25-105-04 for vendor technical details.

Detection Methods for CVE-2025-30512

Indicators of Compromise

Unexpected configuration changes on Growatt-managed devices, including inverter on/off state transitions outside of scheduled operations.
Cloud portal API requests to device configuration endpoints originating from IP addresses not associated with legitimate administrators.
Device operational logs showing setting modifications without a corresponding authenticated user session.

Detection Strategies

Review cloud portal access logs for requests to configuration endpoints that lack authentication headers or session tokens.
Correlate device state changes with authenticated administrator activity and flag mismatches.
Baseline normal configuration change frequency per device and alert on anomalies.

Monitoring Recommendations

Ingest Growatt Cloud Portal audit logs into a centralized SIEM and retain them for incident review.
Monitor for outbound requests from portal infrastructure to devices outside expected maintenance windows.
Alert on repeated configuration write operations targeting multiple device identifiers from a single source.

How to Mitigate CVE-2025-30512

Immediate Actions Required

Apply the vendor-provided remediation referenced in CISA advisory ICSA-25-105-04.
Restrict network exposure of the Growatt Cloud Portal to trusted networks and management VPNs.
Audit recent device configuration changes and revert any unauthorized modifications.

Patch Information

Growatt has addressed the issue as coordinated through CISA. Operators should consult the CISA ICS Advisory ICSA-25-105-04 for the current remediation status and any required client or firmware updates.

Workarounds

Place the cloud portal behind a web application firewall that enforces authentication on configuration endpoints.
Disable remote configuration features for devices that do not require them until the fix is confirmed applied.
Rotate API tokens and administrative credentials after applying the vendor update.

bash

# Example: restrict inbound access to the portal management interface
# Replace <trusted_cidr> with your administrator network range
iptables -A INPUT -p tcp --dport 443 -s <trusted_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP