CVE-2025-31147 Overview
CVE-2025-31147 affects the Growatt Cloud Portal and allows unauthenticated attackers to query the total energy consumed by electric vehicle (EV) chargers belonging to arbitrary users. The flaw is an Insecure Direct Object Reference issue tracked as [CWE-639], where the application fails to validate whether the requester owns the resource being queried. Because the endpoint requires no authentication and can be reached over the network, any remote actor can enumerate energy consumption data across the user base. CISA published details in advisory ICSA-25-105-04.
Critical Impact
Remote, unauthenticated actors can retrieve energy consumption telemetry for arbitrary EV charger owners, enabling large-scale privacy exposure and user enumeration.
Affected Products
- Growatt Cloud Portal (cloud-hosted web application)
- Growatt EV charger accounts managed through the portal
- Downstream mobile and web clients relying on the affected portal APIs
Discovery Timeline
- 2025-04-15 - CVE-2025-31147 published to NVD
- 2025-04-15 - CISA released advisory ICSA-25-105-04
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-31147
Vulnerability Analysis
The Growatt Cloud Portal exposes an API endpoint that returns aggregate energy consumption data for EV chargers. The endpoint accepts a user or device identifier as a request parameter but does not enforce an authentication check or an ownership check on that identifier. An attacker who can reach the portal over the internet can substitute another user's identifier and receive that user's data.
The underlying weakness is [CWE-639]: Authorization Bypass Through User-Controlled Key. Access control depends on the client supplying the correct identifier rather than on server-side session context. Because the server trusts the parameter, it returns records that belong to a different account.
The disclosed impact is confidentiality of energy consumption data. Integrity and availability of the portal are not affected by this specific issue, according to the CVSS vector published for the record.
Root Cause
The root cause is missing server-side authorization enforcement on a network-accessible API endpoint. The endpoint treats user-supplied identifiers as trusted lookup keys instead of validating them against the authenticated session. There is no authentication requirement at all on the affected path, which compounds the exposure.
Attack Vector
Exploitation is remote and unauthenticated. An attacker sends crafted HTTP requests to the Growatt Cloud Portal API, iterating through user or device identifiers to harvest energy consumption values. No user interaction, elevated privileges, or specialized tooling is required. Refer to the CISA ICS Advisory ICSA-25-105-04 for vendor-supplied technical context.
Detection Methods for CVE-2025-31147
Indicators of Compromise
- High-volume requests to Growatt Cloud Portal API endpoints from a single source IP or ASN.
- Sequential or enumerated user or device identifier values within query parameters.
- Requests to energy consumption endpoints that lack a valid session cookie or bearer token.
Detection Strategies
- Inspect web access logs for repeated calls against EV charger data endpoints without corresponding authentication headers.
- Alert on request patterns showing incrementing numeric identifiers, which indicate ID enumeration.
- Correlate portal API traffic with geolocation and reputation feeds to surface anomalous unauthenticated access.
Monitoring Recommendations
- Enable full request logging on the Growatt Cloud Portal edge, including query strings and response sizes.
- Track unauthenticated response volume per endpoint and per source to detect scraping.
- Feed portal logs into a SIEM or data lake and retain them long enough to reconstruct enumeration campaigns.
How to Mitigate CVE-2025-31147
Immediate Actions Required
- Review the CISA ICS Advisory ICSA-25-105-04 and apply the vendor guidance published by Growatt.
- Restrict exposure of the Growatt Cloud Portal API to trusted networks where feasible, and require authenticated sessions on all consumption endpoints.
- Audit recent portal logs for evidence of identifier enumeration and notify affected users if data was exposed.
Patch Information
Growatt operates the Cloud Portal as a hosted service, so remediation is delivered by the vendor rather than through a customer-installed patch. Confirm with Growatt that server-side authorization checks have been added to the affected endpoint and that unauthenticated access is no longer accepted. Track remediation status through the CISA ICS Advisory ICSA-25-105-04.
Workarounds
- Rotate any user or device identifiers that are known to have been exposed, if the vendor supports reassignment.
- Place a web application firewall in front of portal integrations to rate-limit unauthenticated requests to consumption endpoints.
- Block automated scraping patterns at the edge by enforcing per-IP request quotas on API paths that return telemetry.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
