CVE-2025-31933 Overview
CVE-2025-31933 is a username enumeration vulnerability in the Growatt Cloud Portal. An unauthenticated attacker can query an application programming interface (API) endpoint to confirm whether specific usernames exist in the system. The flaw is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key. The vulnerability affects internet-connected solar energy management infrastructure, which raises the concern beyond typical enterprise web applications. CISA published an Industrial Control Systems (ICS) advisory tracking this issue.
Critical Impact
Unauthenticated attackers can enumerate valid usernames in the Growatt Cloud Portal, enabling targeted phishing, credential stuffing, and brute-force campaigns against confirmed accounts.
Affected Products
- Growatt Cloud Portal (all versions per CISA advisory ICSA-25-105-04)
- Web-facing API endpoints exposed by the Growatt Cloud Portal
- Customer accounts associated with Growatt photovoltaic monitoring services
Discovery Timeline
- 2025-04-15 - CVE CVE-2025-31933 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-31933
Vulnerability Analysis
The Growatt Cloud Portal exposes an API endpoint that returns distinguishable responses based on whether a queried username exists. An unauthenticated remote attacker submits a username to the API and can infer account validity from the response. This behavior enables efficient enumeration of the user base without any prior credentials or session context.
The issue is classified as [CWE-639] because the endpoint fails to enforce proper access control on a user-controlled key value, the username. Legitimate application flows such as account registration or password reset typically require this validation, but the response must not disclose account existence. The Growatt Cloud Portal returns oracle-like responses that leak this information.
Root Cause
The root cause is insufficient authorization on an API operation that accepts a username parameter. The response varies based on account existence, producing a side channel that adversaries can query at scale. No authentication or rate limiting stops the enumeration.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker scripts requests against the vulnerable API, iterating through wordlists of usernames, email addresses, or leaked credential dumps. Confirmed accounts feed downstream attacks including credential stuffing, password spraying, and targeted phishing against operators of Growatt solar deployments. The vulnerability does not directly expose credentials or grant portal access, but it materially reduces attacker cost for follow-on intrusions.
See the CISA ICS Advisory ICSA-25-105-04 for vendor coordination details.
Detection Methods for CVE-2025-31933
Indicators of Compromise
- High volumes of unauthenticated requests to Growatt Cloud Portal API endpoints that accept a username or email parameter
- Sequential or dictionary-ordered username values in web server or API gateway logs
- Source IP addresses generating request patterns consistent with automated enumeration tools
- Response-size or response-code disparities in outbound API responses tied to username lookups
Detection Strategies
- Baseline normal API request volumes for account-related endpoints and alert on statistical deviations
- Inspect web application firewall (WAF) logs for repeated requests to authentication-adjacent endpoints from single sources
- Correlate portal API activity with subsequent login failures to identify enumeration followed by credential attacks
Monitoring Recommendations
- Forward Growatt Cloud Portal access logs to a centralized logging platform for retention and analysis
- Monitor for user agents, IP ranges, and geolocations that do not match expected customer populations
- Track failed authentication rates per account after any anomalous enumeration event
How to Mitigate CVE-2025-31933
Immediate Actions Required
- Contact Growatt support to confirm the current status of API-side fixes and apply any available portal updates
- Restrict portal API exposure using network-layer controls where deployment topology permits
- Enforce multi-factor authentication (MFA) on all Growatt Cloud Portal accounts to blunt downstream credential attacks
- Rotate credentials for accounts that show signs of targeted enumeration or subsequent brute-force activity
Patch Information
The vendor coordination and remediation status is tracked in CISA ICS Advisory ICSA-25-105-04. Growatt Cloud Portal is a vendor-hosted service, so fixes are deployed server-side by Growatt rather than by end users. Customers should verify with Growatt that the affected API endpoint no longer discloses account existence.
Workarounds
- Apply rate limiting and bot management at any customer-controlled reverse proxy or WAF fronting portal traffic
- Use unique, non-guessable usernames or email aliases that do not appear in common wordlists
- Deploy MFA and monitor authentication logs for spikes in failed sign-ins tied to enumerated accounts
- Educate users about phishing attempts that reference their Growatt account, as enumerated usernames feed targeted lures
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
