Information Disclosure Vulnerability in EV Chargers by Unauthenticated Attackers
CVE-2025-31147

6.9MEDIUM

Key Information:

Vendor

Growatt

Status
Cloud Portal
Vendor
CVE Published:
15 April 2025

What is CVE-2025-31147?

An information disclosure vulnerability has been identified that allows unauthenticated attackers to query and obtain sensitive information regarding the total energy consumed by electric vehicle (EV) chargers belonging to arbitrary users. This risk raises significant privacy concerns, as attackers could exploit this information for malicious purposes.

Affected Version(s)

Cloud portal 0 < 3.6.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Forescout Technologies reported these vulnerabilities to CISA.
.