CVE-2025-31357: Growatt Cloud Portal Info Disclosure Flaw

CVE-2025-31357 Overview

CVE-2025-31357 affects the Growatt Cloud Portal, a cloud management platform for solar photovoltaic systems. An unauthenticated attacker who knows a valid username can retrieve that user's plant list without any authentication. The flaw stems from an insecure direct object reference tied to the username identifier [CWE-639]. Because the attack requires only network access and no credentials, any remote party can enumerate solar installations associated with known account names. The issue was published to the National Vulnerability Database on 2025-04-15 and coordinated through CISA under advisory ICSA-25-105-04.

Critical Impact
Unauthenticated remote attackers can disclose Growatt Cloud Portal user plant lists by supplying a known username, exposing information about solar energy installations and their owners.

Affected Products

Growatt Cloud Portal (all versions listed in CISA advisory ICSA-25-105-04)
Web-facing cloud management endpoints for Growatt plant data
Any integrations relying on the affected Cloud Portal APIs

Discovery Timeline

2025-04-15 - CVE-2025-31357 published to the National Vulnerability Database
2025-04-15 - CISA publishes ICS advisory ICSA-25-105-04
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31357

Vulnerability Analysis

The vulnerability is an authorization flaw in the Growatt Cloud Portal. A backend endpoint accepts a username as an input parameter and returns the plant list associated with that account. The server does not verify that the requester has authenticated or that the requester owns the target account.

Because the username acts as both an identifier and an implicit authorization token, any client that supplies a valid username receives the corresponding plant records. This behavior is a textbook Authorization through User-Controlled Key issue, mapped to [CWE-639]. Disclosed data can include plant names, locations, and device inventories tied to a solar installation, which supports further reconnaissance against the associated users and hardware.

Root Cause

The root cause is a missing authorization check on a plant-listing API. The endpoint trusts the supplied username and returns records without validating a session token or verifying ownership. Usernames in cloud portals are typically low-entropy and are often reused or guessable, which makes enumeration practical.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker sends a crafted HTTP request to the affected Cloud Portal endpoint with a target username. The server responds with the plant list for that username. Adversaries can pair this with username enumeration or credential leak data to scrape installation inventories at scale.

No verified public exploit code is available. See the CISA ICS Advisory ICSA-25-105-04 for coordinated technical details.

Detection Methods for CVE-2025-31357

Indicators of Compromise

Repeated unauthenticated requests to Growatt Cloud Portal plant-listing endpoints referencing distinct username values
Bursts of sequential or dictionary-style username parameters from a single source IP or ASN
Anomalous outbound API traffic from third-party integrations that pull plant data without an active user session

Detection Strategies

Inspect web access logs for high-volume GET or POST requests that include a username parameter but lack an authenticated session cookie or bearer token
Alert on responses from plant-listing endpoints that return non-empty JSON bodies to unauthenticated clients
Correlate portal access logs with known compromised credential lists to spot targeted enumeration

Monitoring Recommendations

Forward Growatt Cloud Portal application and API gateway logs to a centralized SIEM for retention and correlation
Baseline normal request rates per source IP and trigger on statistical deviations against username query patterns
Monitor for scraping behavior such as user-agent rotation, distributed source IPs, and consistent request intervals

How to Mitigate CVE-2025-31357

Immediate Actions Required

Apply the vendor mitigations described in CISA ICS Advisory ICSA-25-105-04 as soon as Growatt makes updates available
Restrict access to the Growatt Cloud Portal from untrusted networks where operationally feasible
Rotate usernames that are publicly known or reused across services when the platform allows it

Patch Information

Growatt addresses the issue through server-side changes to the Cloud Portal rather than a customer-installable patch. Refer to the CISA ICS Advisory ICSA-25-105-04 for the vendor's remediation status and any required customer actions. Confirm remediation by verifying that unauthenticated requests to plant-listing endpoints return an authentication error rather than data.

Workarounds

Place the Cloud Portal behind a reverse proxy or web application firewall that enforces authentication before requests reach plant-listing endpoints
Rate-limit unauthenticated requests to the portal API to slow enumeration attempts
Advise users to select non-obvious usernames that are not derived from email addresses or company names

bash

# Example WAF rule concept: block unauthenticated access to plant-listing endpoints
# Replace <portal-host> and <plant-endpoint> with the actual values for your deployment
SecRule REQUEST_URI "@beginsWith /<plant-endpoint>" \
  "id:1003157,phase:1,deny,status:401,\
   chain,msg:'Block unauthenticated Growatt plant list access (CVE-2025-31357)'"
  SecRule &REQUEST_HEADERS:Authorization "@eq 0"