CVE-2025-27929 Growatt CVE debrief

Who should care

Operators, installers, and administrators using Growatt cloud portal versions up to 3.6.0; security teams responsible for account privacy, access monitoring, and cloud service hygiene; and organizations that rely on Growatt-managed monitoring portals.

Technical summary

The source advisory describes an unauthenticated information exposure affecting the Growatt cloud portal. According to CISA’s CSAF record, attackers could retrieve the full list of users associated with arbitrary accounts, and the affected product scope is Growatt cloud portal <=3.6.0. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, with a score of 5.3 (Medium). The advisory’s narrative centers on unauthorized disclosure of account-user associations, while the CVSS vector assigns low integrity impact in the published assessment.

Defensive priority

Medium: address promptly because the issue is network-reachable and requires no authentication, but the advisory does not describe code execution or service disruption.

Recommended defensive actions

• Confirm the Growatt cloud portal is on the latest vendor-fixed version and that any automatic cloud-side updates have been applied.
• Review account membership and access records for unusual bulk lookups or unexpected account enumeration activity.
• Use strong passwords and enable multi-factor authentication where applicable.
• Follow CISA ICS recommended practices for account security, monitoring, and defensive depth.
• Report any security concerns to [email protected] if you observe suspicious behavior.

Evidence notes

Primary evidence comes from CISA’s CSAF advisory ICSA-25-105-04 and its referenced source JSON. The advisory states: unauthenticated attackers can retrieve the full list of users associated with arbitrary accounts. The affected product is listed as Growatt cloud portal <=3.6.0. Remediations in the advisory say Growatt patched the cloud-based vulnerabilities and no user action is needed, while also recommending password hygiene, MFA where applicable, and vigilance. Publication and revision timing are taken from the advisory metadata: initial publication on 2025-04-15 and revision 2 on 2025-05-06 for typo fixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.