Information Disclosure Vulnerability in Smart Home Device Management
CVE-2025-31654
6.9MEDIUM
Key Information:
- Vendor
- Growatt
- Status
- Cloud Portal
- Vendor
- CVE Published:
- 15 April 2025
Summary
A security vulnerability exists within the smart home device management framework, allowing unauthorized attackers to access sensitive information regarding user groups and associated devices, commonly referred to as 'rooms'. This breach could lead to a compromised user privacy and potential exploitation of the system, requiring urgent attention to bolster the security measures in place.
Affected Version(s)
Cloud portal 0 < 3.6.0
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Forescout Technologies reported these vulnerabilities to CISA.