CVE-2025-31949 Growatt CVE debrief

Who should care

Operators and administrators using Growatt cloud portal, especially environments that manage plant identifiers or expose portal access to authenticated users. Security teams responsible for OT/ICS-adjacent cloud services should also review account controls and access logging.

Technical summary

The source advisory describes a confidentiality-only issue: an authenticated attacker can retrieve a plant name by knowing a plant ID. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, matching a network-reachable issue with low confidentiality impact and no stated integrity or availability impact. The affected product entry in the CSAF data is "Growatt Growatt cloud portal: <=3.6.0."

Defensive priority

Moderate. This is not a KEV-listed issue in the supplied corpus and the reported impact is limited to low confidentiality exposure, but it still warrants review because it affects a cloud portal used for device/plant management.

Recommended defensive actions

• Confirm whether any environments use Growatt cloud portal version 3.6.0 or earlier.
• Apply vendor updates or verify that the cloud-side patch has been received, since Growatt states the cloud vulnerabilities were patched and no user action is needed.
• Enforce strong passwords and enable multi-factor authentication where applicable.
• Review portal access logs for unusual authenticated lookups or abnormal plant-ID enumeration patterns.
• Follow Growatt’s reporting path for security concerns ([email protected]).
• Use CISA industrial control systems best practices and recommended practices for account security and defense-in-depth.

Evidence notes

The source corpus explicitly states: "An authenticated attacker can obtain any plant name by knowing the plant ID." It also lists the affected product as "Growatt Growatt cloud portal: <=3.6.0" and includes Growatt’s remediation note that the cloud-based vulnerabilities were patched and no user action is needed. The advisory publication date is 2025-04-15 and the only later revision recorded is 2025-05-06 for typo fixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.