PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-31147 Growatt CVE debrief

CVE-2025-31147 affects the Growatt cloud portal and is rated Medium (CVSS 5.3). According to CISA’s advisory, unauthenticated attackers could query information about the total energy consumed by EV chargers belonging to arbitrary users. The advisory covers Growatt cloud portal versions up to 3.6.0. Growatt states the cloud-based vulnerabilities were patched and that no user action is needed, while also recommending standard account and device hygiene such as strong passwords, MFA where applicable, and review of security settings.

Vendor
Growatt
Product
Cloud portal
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-15
Original CVE updated
2025-05-06
Advisory published
2025-04-15
Advisory updated
2025-05-06

Who should care

Operators, administrators, and users of Growatt cloud portal deployments for EV charging should care, especially teams responsible for monitoring customer usage data, account access, and cloud-connected charging infrastructure.

Technical summary

The issue is an information disclosure condition in the Growatt cloud portal: unauthenticated remote access can be used to retrieve total-energy-consumption information for EV chargers tied to arbitrary users. The advisory identifies affected products as Growatt cloud portal versions <=3.6.0. The published CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating a network-reachable issue with low confidentiality impact and no integrity or availability impact.

Defensive priority

Medium. The exposure is externally reachable and requires no authentication, but the disclosed data is limited to confidentiality impact. Treat it as a priority for cloud portal operators handling user charging data, and verify patch status promptly.

Recommended defensive actions

  • Verify that all Growatt cloud portal instances are running the fixed version or the latest available update path.
  • Confirm whether any connected devices or cloud services still report as affected by versions <=3.6.0.
  • Review access controls and monitoring for unusual queries or data access patterns involving charging-usage information.
  • Use strong passwords and enable multi-factor authentication where applicable, as recommended in the advisory.
  • Follow Growatt’s guidance to stay vigilant and review security settings regularly.
  • Report security concerns to [email protected] if suspicious activity or exposure is identified.

Evidence notes

All substantive claims here are taken from the CISA CSAF advisory for ICSA-25-105-04/CVE-2025-31147 and its revision history. The published date used is 2025-04-15, and the 2025-05-06 modification is described by CISA as typo fixes only.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-31147 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-31147

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-31147 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-31147

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-105-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.