Growatt Cloud Applications Smart Meter Serial Number Retrieval Vulnerability

A vulnerability exists in Growatt cloud applications, specifically in the cloud portal versions through 3.6.0, allowing unauthenticated attackers to obtain the serial numbers of smart meters. This is achieved by using the owner's username to query an unprotected API, which responds with the requested serial number.

Impact

Exploitation of this vulnerability allows for unauthorized access to smart meter serial numbers, potentially leading to further exploitation or manipulation of smart meter data.

Remediation

Growatt has reported that the cloud-based vulnerabilities were patched and no user action is needed. Users are advised to update all devices to the latest firmware version when available, use strong passwords, enable multi-factor authentication where applicable, and report any security concerns to Growatt's service email. CISA recommends minimizing network exposure for control system devices, using firewalls to isolate control system networks from business networks, and employing secure remote access methods like VPNs.