CVE-2025-31360 Growatt CVE debrief

Who should care

Owners and operators of Growatt cloud portal deployments, plus installers and administrators responsible for connected devices and user accounts. Even though the vendor states the cloud issues were patched automatically, organizations should still verify account security settings and monitor for unexpected device behavior.

Technical summary

CISA’s advisory describes an unauthenticated network-reachable issue where attackers can trigger device actions tied to specific scenes belonging to arbitrary users. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, which indicates no confidentiality impact but low integrity and availability impact. The affected product listed in the CSAF is Growatt cloud portal <=3.6.0.

Defensive priority

Medium. The vendor states the cloud vulnerabilities were patched and no user action is needed for the patch itself, but account hardening, monitoring, and review of device activity remain prudent.

Recommended defensive actions

• Confirm exposure of Growatt cloud portal accounts and devices covered by the advisory ICSA-25-105-04.
• Ensure devices and associated cloud services are on the latest available firmware/version; Growatt states updates are automatic.
• Use strong passwords and enable multi-factor authentication where applicable.
• Review security settings regularly and investigate any unusual device or scene activity.
• Report security concerns to [email protected].
• Follow CISA industrial control system recommended practices for account, device, and network hardening.

Evidence notes

The source advisory (CISA CSAF ICSA-25-105-04) identifies Growatt cloud portal <=3.6.0 as affected and states: "Unauthenticated attackers can trigger device actions associated with specific \"scenes\" of arbitrary users." The advisory was initially published on 2025-04-15 and revised on 2025-05-06 for typos only. The remediation section says Growatt patched the cloud-based vulnerabilities and that updates are automatic, while also recommending strong passwords, MFA where applicable, and vigilance for unusual activity.

Official resources