Username Enumeration Vulnerability in Affected Web Applications
CVE-2025-24487

6.9MEDIUM

Key Information:

Vendor

Growatt

Status
Cloud Portal
Vendor
CVE Published:
15 April 2025

What is CVE-2025-24487?

An unauthenticated attacker can exploit this vulnerability by sending queries to the API, potentially revealing the existence of usernames within the system. This type of exposure can lead to further attacks, such as credential stuffing or phishing, as attackers may use the gleaned information to target valid accounts. It emphasizes the need for stringent input validation and security measures to protect against unauthorized access and data leakage.

Affected Version(s)

Cloud portal 0 < 3.6.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Forescout Technologies reported these vulnerabilities to CISA.
.