CVE-2025-31945: Growatt Cloud Portal Info Disclosure Flaw

CVE-2025-31945 Overview

CVE-2025-31945 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting the Growatt Cloud Portal. An unauthenticated remote attacker can query the portal and obtain charger information belonging to other users. The flaw stems from authorization controls that fail to validate whether the requesting party owns or has permission to access the referenced charger resource. Growatt Cloud Portal manages solar energy and electric vehicle charging assets, so exposed information can include device identifiers and configuration data tied to specific customers. The vulnerability was disclosed through CISA advisory ICSA-25-105-04 covering multiple issues in Growatt cloud services.

Critical Impact
Unauthenticated network-based access to charger information belonging to other Growatt customers, enabling reconnaissance of connected energy assets.

Affected Products

Growatt Cloud Portal (all versions prior to vendor remediation)
Cloud-managed Growatt EV chargers registered to the portal
Customer accounts with charger assets linked to the portal

Discovery Timeline

2025-04-15 - CVE-2025-31945 published to NVD alongside CISA ICS advisory ICSA-25-105-04
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31945

Vulnerability Analysis

The Growatt Cloud Portal exposes API endpoints that return charger information based on identifiers supplied by the client. The server accepts these requests without confirming that the caller is authenticated or authorized to view the referenced resource. As a result, an attacker can iterate through charger identifiers and retrieve data records belonging to arbitrary accounts. This is a classic Insecure Direct Object Reference pattern, catalogued under CWE-639. The attack requires no credentials, no user interaction, and no elevated privileges. Because the portal is internet-facing, exploitation can be performed from any network position. The information returned enables attackers to enumerate customer assets, map charger deployments, and prepare follow-on attacks against connected devices or account holders.

Root Cause

The root cause is missing authorization on API endpoints that accept a charger identifier as an input parameter. The application trusts the identifier supplied by the client and returns the corresponding record without verifying object ownership against the session context. Requests lacking a session token are also processed, which compounds the exposure.

Attack Vector

Attackers reach the vulnerable endpoints over the public internet using standard HTTPS requests. Exploitation involves submitting crafted requests containing predictable or enumerable charger identifiers. The server responds with data belonging to whichever account owns the referenced identifier. Automated enumeration allows large-scale extraction across the customer base. No verified proof-of-concept code is published for CVE-2025-31945, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the CISA ICS Advisory ICSA-25-105-04 for vendor-coordinated technical details.

Detection Methods for CVE-2025-31945

Indicators of Compromise

Anomalous volumes of requests to Growatt Cloud Portal charger API endpoints from a single source IP address
Requests to charger data endpoints missing authentication headers or session cookies
Sequential or enumerative access patterns targeting charger identifiers across account boundaries
Outbound traffic from operator networks to unfamiliar IPs correlating with portal API activity

Detection Strategies

Review Growatt Cloud Portal access logs for unauthenticated requests that returned HTTP 200 responses on charger endpoints
Alert on rapid iteration of numeric or sequential resource identifiers within short time windows
Correlate source IPs querying charger endpoints against threat intelligence feeds for known scanners and abusive infrastructure
Baseline normal API request rates per client and flag deviations that suggest enumeration

Monitoring Recommendations

Enable full request logging on portal API endpoints, including source IP, session identity, and requested object ID
Forward web application firewall and portal telemetry to a centralized log platform for retention and search
Monitor CISA and Growatt security channels for updated advisories referencing ICSA-25-105-04
Track EPSS score changes for CVE-2025-31945 to reprioritize response as exploitation likelihood evolves

How to Mitigate CVE-2025-31945

Immediate Actions Required

Contact Growatt support to confirm that the account and connected chargers are running on remediated backend services
Restrict portal accounts to strong, unique passwords and enable multi-factor authentication where offered
Audit exposed charger identifiers and rotate any device credentials that may have been enumerated
Review recent portal activity logs for signs of unauthorized data access tied to charger assets

Patch Information

CVE-2025-31945 affects a vendor-hosted cloud service. Remediation is applied server-side by Growatt rather than through customer-installed patches. CISA advisory ICSA-25-105-04 documents the vendor response and recommended defensive measures for Growatt customers. Verify with Growatt support that fixes have been deployed to the tenant serving your account.

Workarounds

Limit publicly visible references to charger identifiers, serial numbers, and account details in customer-facing materials
Segment operational technology networks so that charger management traffic is isolated from general-purpose networks
Disable or unregister chargers that are not in active use to reduce the exploitable attack surface
Subscribe to CISA ICS advisories and Growatt notifications to receive timely updates on further disclosures

bash

# Example: review outbound connections from OT segment to Growatt cloud endpoints
sudo tcpdump -n -i eth0 'host server.growatt.com and port 443'