CVE-2025-27719 Growatt CVE debrief

Who should care

Operators, installers, and administrators using the Growatt cloud portal, especially environments still on versions at or below 3.6.0. Because the issue is reachable without authentication and affects device-detail exposure, organizations that rely on the portal for monitoring or fleet visibility should review access controls and account hygiene.

Technical summary

According to the CISA CSAF record, Growatt cloud portal versions <=3.6.0 are affected. The issue is that an unauthenticated attacker can query an API endpoint and get device details. The advisory’s CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network-reachable exposure with low confidentiality impact and no integrity or availability impact in the supplied scoring.

Defensive priority

Moderate. The issue is externally reachable and requires no authentication, but the supplied advisory rates impact as low and does not list the CVE in KEV. Prioritize if the cloud portal is internet-facing or used to manage sensitive device fleets.

Recommended defensive actions

• Apply Growatt’s latest firmware/software updates when available; the advisory states updates are automatic and no user action is needed.
• Use strong passwords and enable multi-factor authentication where applicable.
• Review security settings regularly and watch for unusual activity in Growatt cloud accounts and devices.
• Report security concerns to [email protected] using the contact provided in the advisory.

Evidence notes

All claims above are drawn from the supplied CISA CSAF source item for ICSA-25-105-04 and its embedded metadata. The advisory names the affected product as Growatt cloud portal and lists affected versions as <=3.6.0. It also states: “Unauthenticated attackers can query an API endpoint and get device details.” The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The revision history shows the original publication on 2025-04-15 and a later revision on 2025-05-06 for typo fixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.