CVE-2025-27927 Growatt CVE debrief

Who should care

Organizations and individuals using Growatt cloud portal services, especially administrators, installers, and operators who manage smart devices through the portal. Security teams responsible for internet-facing vendor cloud services and any environment where device inventory exposure would be sensitive should also review this advisory.

Technical summary

CVE-2025-27927 describes an API access-control weakness in Growatt cloud applications. The advisory states that unauthenticated attackers can obtain a list of smart devices if they know a valid username, indicating the API does not adequately protect device-list retrieval. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) aligns with a network-reachable issue that impacts confidentiality only, with no integrity or availability impact described in the advisory.

Defensive priority

Medium. The issue does not describe code execution or service disruption, but it can expose device inventory information and should be treated as a privacy and reconnaissance risk, especially for cloud-managed OT or smart-device environments.

Recommended defensive actions

• Confirm whether any assets use Growatt cloud portal versions <=3.6.0 and prioritize applying the latest available firmware or cloud updates.
• Review account security for Growatt-managed access: use strong passwords and enable multi-factor authentication where applicable.
• Monitor for unusual account activity or unexpected device-list access tied to valid usernames.
• Follow Growatt's advisory guidance and report security concerns to [email protected].
• Apply standard ICS security best practices and keep security settings under regular review.

Evidence notes

All factual statements are grounded in the supplied CISA CSAF advisory and the provided CVE metadata. The advisory identifies the affected product as Growatt cloud portal <=3.6.0, describes the unauthenticated device-list exposure via an unprotected API, and states that Growatt reports the cloud-based vulnerabilities were patched. The advisory revision on 2025-05-06 is described as fixing typos only; no new technical impact was introduced in the supplied source.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.