PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-31950 Growatt CVE debrief

CVE-2025-31950 is a Growatt cloud portal issue affecting versions <=3.6.0, where an unauthenticated attacker can obtain other users’ EV charger energy consumption information. CISA published the advisory on 2025-04-15 and later revised it on 2025-05-06 for typo fixes; the vendor states the cloud-based vulnerabilities were patched and no user action is needed.

Vendor
Growatt
Product
Cloud portal
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-15
Original CVE updated
2025-05-06
Advisory published
2025-04-15
Advisory updated
2025-05-06

Who should care

Operators, installers, and users of Growatt cloud portal-connected EV charging systems should pay attention, along with security teams responsible for cloud-connected energy or OT/IoT deployments.

Technical summary

The advisory describes a network-reachable information disclosure condition in the Growatt cloud portal. The provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting no authentication required, low attack complexity, and limited confidentiality impact only. The affected product listed in the CSAF advisory is Growatt cloud portal <=3.6.0.

Defensive priority

Medium. This is a privacy/confidentiality exposure rather than an integrity or availability issue, but it affects unauthenticated access to user energy-consumption data in a cloud service.

Recommended defensive actions

  • Confirm whether any deployed Growatt cloud portal components are at or below version 3.6.0.
  • Apply vendor-provided updates; the advisory states cloud-based vulnerabilities were patched and updates are automatic.
  • Use strong passwords and enable multi-factor authentication where applicable.
  • Review security settings regularly and report unusual activity.
  • If you identify security concerns, contact Growatt at [email protected].

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-25-105-04 and its source JSON, which identify the issue as an unauthenticated ability to obtain other users’ EV charger energy consumption information. The advisory lists Growatt cloud portal <=3.6.0 as affected and includes vendor remediation guidance stating the cloud vulnerabilities were patched and no user action is needed. Published date used here is 2025-04-15, with a later advisory revision on 2025-05-06 for typos only.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-31950 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-31950

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-31950 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-31950

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-105-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.