Information Disclosure Vulnerability in EV Chargers by Various Vendors
CVE-2025-27575

6.9MEDIUM

Key Information:

Vendor

Growatt

Status
Cloud Portal
Vendor
CVE Published:
15 April 2025

What is CVE-2025-27575?

An information disclosure vulnerability exists in certain EV chargers, allowing unauthenticated attackers to access sensitive data such as the version and firmware upgrade history by simply knowing the charger ID. This risk could potentially enable malicious actors to exploit weaknesses in the firmware or plan further attacks against the system. Secure configurations and timely updates are strongly recommended to mitigate this risk.

Affected Version(s)

Cloud portal 0 < 3.6.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Forescout Technologies reported these vulnerabilities to CISA.
.