CVE-2025-30512 Growatt CVE debrief

Who should care

Organizations using Growatt cloud portal deployments, along with administrators, installers, and operators responsible for managing connected devices through the portal. Security teams should pay particular attention if any devices may still be on versions at or below 3.6.0.

Technical summary

The advisory identifies a network-reachable, unauthenticated weakness affecting Growatt cloud portal versions <=3.6.0. According to the CISA CSAF, an attacker can send configuration settings to the device and may remotely perform physical actions such as on/off control. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, which aligns with a remotely exploitable issue that does not require privileges or user interaction and has low integrity and availability impact.

Defensive priority

Moderate priority. The issue is already described by the vendor as patched, so the main priority is confirming affected devices are covered by the latest firmware/software state, then validating account security and monitoring for unexpected changes or device actions.

Recommended defensive actions

• Confirm whether any environment assets use Growatt cloud portal versions at or below 3.6.0.
• Apply the latest firmware/software updates where available; Growatt states updates are automatic and no user action is needed.
• Use strong passwords and enable multi-factor authentication where applicable.
• Review device and cloud portal security settings regularly and look for unusual configuration changes or on/off activity.
• Report security concerns to Growatt at [email protected].

Evidence notes

All substantive claims in this debrief are taken from the supplied CISA CSAF advisory for ICSA-25-105-04 / CVE-2025-30512 and its embedded remediation guidance. The advisory lists the affected product as Growatt cloud portal <=3.6.0, describes unauthenticated configuration-setting access and possible remote physical actions, and records publication on 2025-04-15 with a 2025-05-06 revision limited to typo fixes. The supplied CVSS v3.1 vector supports the stated network-accessible, no-authentication risk profile.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.