CVE-2025-31941 Growatt CVE debrief

Who should care

Organizations and individuals using Growatt cloud portal deployments, especially administrators, installers, and operations teams managing connected smart devices. Security teams responsible for account hygiene, access control, and monitoring should also review this advisory.

Technical summary

The advisory describes an information disclosure issue in the Growatt cloud portal, affecting Growatt cloud portal versions <=3.6.0. The attack requires no authentication and no user interaction, but does require knowledge of a valid username. The supplied CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) aligns with a low confidentiality impact and no integrity or availability impact. CISA’s CSAF entry lists the issue as a single affected product family and points to vendor-provided mitigation steps rather than an exploit narrative.

Defensive priority

Moderate. The issue is network-reachable and unauthenticated, but the reported impact is limited to confidentiality and the advisory indicates the cloud vulnerabilities were patched. Priority should be driven by exposure of Growatt cloud portal accounts and the sensitivity of device inventory information.

Recommended defensive actions

• Confirm whether any environment uses Growatt cloud portal versions covered by the advisory (<=3.6.0).
• Apply Growatt-provided updates or confirm that automatic updates have completed.
• Review account security for Growatt cloud users, including strong passwords and multi-factor authentication where available.
• Monitor for unusual account activity or unexpected device-list access.
• Report security concerns to Growatt at [email protected], as recommended in the advisory.

Evidence notes

Primary evidence comes from CISA’s CSAF advisory ICSA-25-105-04 for CVE-2025-31941, which identifies the affected product as Growatt cloud portal <=3.6.0 and describes the issue as unauthenticated device-list access when a valid username is known. The advisory also includes the vendor remediation notes stating the cloud-based vulnerabilities were patched, with automatic updates and account-security recommendations. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, consistent with the stated impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.