CVE-2025-31941 Overview
CVE-2025-31941 is an authorization vulnerability in the Growatt Cloud Portal. An unauthenticated attacker who knows a valid username can retrieve a list of smart devices associated with that account. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key. CISA published advisory ICSA-25-105-04 covering this issue among other Growatt weaknesses.
Critical Impact
Unauthenticated attackers can enumerate smart devices tied to any known username, exposing customer device inventory and enabling targeted follow-on attacks against solar and energy management infrastructure.
Affected Products
- Growatt Cloud Portal (all versions prior to the vendor fix)
- Growatt web-based device management interfaces
- Growatt smart device account services
Discovery Timeline
- 2025-04-15 - CVE-2025-31941 published to the National Vulnerability Database (NVD)
- 2025-04-15 - CISA released ICS advisory ICSA-25-105-04
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-31941
Vulnerability Analysis
The Growatt Cloud Portal exposes device inventory data through an endpoint that does not enforce authentication. An attacker who supplies a valid username in the request receives the list of smart devices linked to that account. No password, token, or session context is required. This constitutes an authorization bypass through a user-controlled key, tracked as CWE-639.
The disclosure reveals device metadata belonging to legitimate customers. Attackers can pair harvested device inventories with other Growatt vulnerabilities disclosed in ICSA-25-105-04 to pivot toward device control or account takeover. The impact is limited to confidentiality of device listings; integrity and availability are not directly affected.
Root Cause
The portal API treats the supplied username as an implicit authorization token. The backend performs a lookup on the username and returns associated device records without verifying that the caller owns the account or holds a valid session. This is a classic broken object-level authorization pattern in web APIs.
Attack Vector
Exploitation occurs over the network against the public Growatt Cloud Portal. The attacker needs only a valid username, which can be obtained through open-source intelligence, prior breaches, phishing, or brute-force enumeration of common usernames. The attacker sends a crafted HTTP request referencing the target username and parses the returned device list. No user interaction is required.
See the CISA advisory ICSA-25-105-04 for coordinated disclosure details. No public proof-of-concept is available.
Detection Methods for CVE-2025-31941
Indicators of Compromise
- Unusual volumes of anonymous HTTP requests to Growatt Cloud Portal device listing endpoints referencing multiple distinct usernames.
- Requests from single source IPs iterating through username values in short time windows.
- Access log entries returning device inventory payloads without a preceding authentication event.
Detection Strategies
- Review web access logs for the Growatt Cloud Portal for enumeration patterns where a single client queries device data for many usernames.
- Correlate portal API responses containing device identifiers with the absence of an authenticated session cookie or bearer token.
- Alert on requests from cloud hosting ranges, TOR exit nodes, or geolocations that do not match the legitimate user base.
Monitoring Recommendations
- Enable rate limiting and anomaly detection on the device listing endpoint and forward logs to a centralized analytics platform.
- Track failed and successful device enumeration attempts per source IP over rolling windows to identify scraping activity.
- Monitor customer support channels for user reports of unexpected notifications, unfamiliar sessions, or altered device settings.
How to Mitigate CVE-2025-31941
Immediate Actions Required
- Apply the vendor-supplied fix once available and confirm the portal enforces authentication on all device inventory endpoints.
- Force password rotation and review account activity for users whose usernames may have been exposed publicly.
- Restrict access to the Growatt Cloud Portal through IP allowlisting or VPN where operationally feasible.
Patch Information
Growatt has coordinated remediation with CISA. Refer to CISA advisory ICSA-25-105-04 for the current vendor guidance and mitigation status. Growatt operates the portal as a cloud service, so fixes are deployed server-side by the vendor rather than through customer patching.
Workarounds
- Avoid using guessable or publicly known email addresses as portal usernames where the account model permits.
- Enable multi-factor authentication on Growatt accounts to reduce the impact of any subsequent credential-based attacks that leverage enumerated device data.
- Segment and monitor networks hosting Growatt inverters and gateways so that any follow-on activity against enumerated devices is detected quickly.
# Configuration example
# Restrict outbound access from OT/IoT segments to only required Growatt endpoints
iptables -A OUTPUT -s 10.20.0.0/24 -d server.growatt.com -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -s 10.20.0.0/24 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
