CVE-2025-24487

An unauthenticated attacker can infer the existence of usernames in the system by querying an API.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - ics-cert@hq.dhs.gov

Published

2025-04-15

Last modified

2025-04-16

Weaknesses

CWE-639

Affected products

• Cloud Portal (Growatt)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04