Cloud Portal
CVE-2025-31941
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | CVSS score of 6.9 (MEDIUM). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.27%. |
| Exploit ScenarioDerived | This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the medium-severity affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified under CWE-639. An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. Affected products include: Growatt Cloud Portal.
Know when Cloud Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
Executive ViewAI
CVE-2025-31941 presents notable security risk, a IDOR vulnerability rated CVSS 6.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Cloud Portal
View allDue to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces o
An attacker can upload an arbitrary file instead of a plant image. Rated critical severity (CVSS 9.3), this vulnerabilit
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while addin
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g.
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Rated medium
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. Rated medium severity (CVS
Unauthenticated attackers can rename "rooms" of arbitrary users. Rated medium severity (CVSS 6.9), this vulnerability is
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
An unauthenticated attacker can hijack other users' devices and potentially control them. Rated medium severity (CVSS 6.
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). Rated medium severity (CV
An unauthenticated attacker can obtain EV charger energy consumption information of other users. Rated medium severity (
An unauthenticated attacker can obtain other users' charger information. Rated medium severity (CVSS 6.9), this vulnerab
GitHub PoC
Exploit-DB