Growatt Cloud Applications Authorization Bypass Vulnerability Allowing Email Harvesting

An authorization bypass vulnerability has been identified in Growatt Cloud Applications, specifically in the cloud portal version 3.6.0 and prior. This vulnerability allows unauthenticated attackers to harvest users' email addresses by knowing their usernames. When a username is provided, the system responds by sending a password reset email to the associated email address, thereby disclosing it to the attacker.

Impact

Exploitation of this vulnerability could lead to unauthorized access to users' email addresses, potentially allowing for further social engineering attacks or unauthorized account access.

Remediation

Growatt has reported that the cloud-based vulnerabilities were patched and no user action is needed. Users are advised to update all devices to the latest firmware version when available, use strong passwords, enable multi-factor authentication where applicable, and report any security concerns to Growatt's customer service. CISA also recommends minimizing network exposure for control system devices, locating them behind firewalls, and using secure remote access methods like VPNs.