CVE-2025-36752

critical · 9.4

Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.

9.4

CVSS

0.3%

EPSS (exploit prob.)

25th

EPSS percentile

2025-12-13

Published

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
growatt	shine_lan-x_firmware	>= 3.6.0.0, < 3.6.0.2
growatt	shine_lan-x	all versions

Check a specific version with /api/v1/cve/match.

References

https://csirt.divd.nl/CVE-2025-36752/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-36752