Unauthenticated Access Vulnerability in ICS Devices by CISA
CVE-2025-31360

6.9MEDIUM

Key Information:

Vendor

Growatt

Status
Cloud Portal
Vendor
CVE Published:
15 April 2025

What is CVE-2025-31360?

This vulnerability allows unauthenticated attackers to trigger device actions related to specific scenes belonging to arbitrary users, leading to unauthorized control over the affected ICS devices. By exploiting this flaw, attackers could interfere with operational functions, posing a significant security risk. This vulnerability emphasizes the need for robust authentication measures to protect sensitive industrial environments.

Affected Version(s)

Cloud portal 0 < 3.6.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Forescout Technologies reported these vulnerabilities to CISA.
.