CVE-2025-31945 Growatt CVE debrief

Who should care

Owners, operators, and installers using Growatt cloud portal services, especially anyone responsible for charger fleet privacy, account security, or monitoring user-access activity.

Technical summary

According to the CISA CSAF advisory, the affected product is "Growatt Growatt cloud portal: <=3.6.0." The issue is described as an unauthenticated information-disclosure problem: an attacker without credentials can obtain other users' charger information. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which aligns with a network-reachable, low-complexity confidentiality impact and no stated integrity or availability impact.

Defensive priority

Moderate. The flaw is unauthenticated and network-reachable, but the stated impact is limited to information disclosure rather than code execution or service disruption. Prioritize it for environments where charger telemetry or user-linked information is sensitive.

Recommended defensive actions

• Confirm whether your environment uses Growatt cloud portal versions at or below 3.6.0.
• Apply vendor updates and keep devices on the latest firmware version; Growatt says updates are automatic and no user action is needed.
• Review account security settings, use strong passwords, and enable multi-factor authentication where applicable.
• Monitor for unusual account or charger-access activity and investigate unexpected data exposure.
• Report security concerns to Growatt at [email protected].
• Follow CISA industrial control system recommended practices for account hygiene, monitoring, and defense in depth.

Evidence notes

Source evidence comes from CISA's CSAF advisory ICSA-25-105-04 for "Growatt Cloud Applications," published 2025-04-15 and revised 2025-05-06. The advisory states that an unauthenticated attacker can obtain other users' charger information and identifies the affected product as "Growatt Growatt cloud portal: <=3.6.0." Growatt's remediation text says the cloud-based vulnerabilities were patched and that no user action is needed; it also recommends firmware updates, strong passwords, MFA where applicable, and vigilance. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.