CVE-2025-31654 Overview
CVE-2025-31654 is an authorization vulnerability in the Growatt Cloud Portal. An unauthenticated attacker can retrieve information about smart home device groups (referred to as "rooms") belonging to arbitrary users. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key, commonly known as an Insecure Direct Object Reference (IDOR).
The vulnerability was disclosed through CISA ICS Advisory ICSA-25-105-04, which covers multiple issues affecting Growatt's cloud infrastructure used to manage residential and commercial solar and smart home installations.
Critical Impact
Remote, unauthenticated attackers can enumerate smart home device group data belonging to arbitrary Growatt Cloud Portal users, exposing information about victims' home environments.
Affected Products
- Growatt Cloud Portal (web application)
- Growatt smart home device management interfaces tied to the cloud portal
- User accounts with associated smart home "room" groupings
Discovery Timeline
- 2025-04-15 - CVE-2025-31654 published to the National Vulnerability Database (NVD)
- 2025-04-15 - CISA publishes ICS Advisory ICSA-25-105-04 covering Growatt Cloud Portal issues
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-31654
Vulnerability Analysis
The Growatt Cloud Portal exposes API endpoints that return smart home device group data. The application fails to properly verify that the requesting user is authorized to view the requested group. As a result, an attacker can supply an identifier belonging to another user and receive information back from the API.
This pattern falls under [CWE-639], where access decisions rely on a user-controlled key such as a group ID or user ID without a corresponding authorization check. The endpoint trusts the client-supplied identifier and returns data regardless of ownership.
Exploitation requires only network access to the portal. No authentication, user interaction, or elevated privileges are required, per the CVSS 4.0 metrics. The impact is limited to confidentiality of information about device groupings, not direct control of the devices themselves.
Root Cause
The root cause is missing server-side authorization on API operations that return "room" or device group data. The backend accepts a user or group identifier from the request and returns the associated records without validating that the current session owns the resource.
Attack Vector
An attacker interacts with the Growatt Cloud Portal API over the internet and iterates through user or group identifiers. For each valid identifier, the API returns smart home group information belonging to that user. Attackers can automate enumeration to build a dataset of Growatt users and their smart home configurations.
See CISA ICS Advisory ICSA-25-105-04 for vendor-coordinated technical details.
Detection Methods for CVE-2025-31654
Indicators of Compromise
- High-volume sequential requests to Growatt Cloud Portal endpoints that reference user or group identifiers
- Requests originating from a single IP address that iterate through numeric IDs
- Anomalous API traffic patterns targeting device group or "room" endpoints outside normal user session flows
Detection Strategies
- Review Growatt Cloud Portal access logs for enumeration patterns against endpoints that return device group information
- Correlate source IPs making bulk API queries with known scanner or proxy infrastructure
- Alert on requests that return successful responses for group IDs not associated with the authenticated session
Monitoring Recommendations
- Ingest cloud portal and API gateway logs into a centralized logging or SIEM platform for longitudinal analysis
- Baseline typical per-user API call volumes and alert on statistical outliers
- Monitor for unauthorized data egress patterns from the cloud portal backend
How to Mitigate CVE-2025-31654
Immediate Actions Required
- Review the CISA ICS Advisory ICSA-25-105-04 and apply vendor guidance for the Growatt Cloud Portal
- Restrict exposure of Growatt device management to trusted networks where feasible
- Rotate credentials associated with Growatt Cloud Portal accounts as a precaution
Patch Information
Growatt Cloud Portal is a vendor-operated cloud service. Remediation is applied server-side by Growatt rather than through a customer-installed patch. Refer to CISA ICS Advisory ICSA-25-105-04 for the current mitigation status and any customer actions required.
Workarounds
- Limit the amount of sensitive metadata (such as descriptive room or device names) stored in the Growatt Cloud Portal
- Where possible, segment smart home devices onto isolated network segments to reduce downstream impact of disclosed information
- Monitor Growatt account activity logs for unfamiliar sessions or configuration changes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
