Growatt ShineLan-X up to 3.6.0.2 Communication Dongle hard-coded credentials

Summaryinfo

A vulnerability was found in Growatt ShineLan-X up to 3.6.0.2. It has been declared as critical. Affected by this issue is some unknown functionality of the component Communication Dongle. Executing a manipulation can lead to hard-coded credentials. This vulnerability is registered as CVE-2025-36752. The attack requires access to the local network. No exploit is available.

Detailsinfo

A vulnerability has been found in Growatt ShineLan-X up to 3.6.0.2 and classified as critical. This vulnerability affects some unknown processing of the component Communication Dongle. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.

The weakness was published by Alexandros Tokatlis and Victor Pasman. The advisory is available at csirt.divd.nl. This vulnerability was named CVE-2025-36752 since 04/15/2025. The exploitation appears to be easy. Access to the local network is required for this attack to succeed. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/15/2026). This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-203251). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Growatt

Name

• ShineLan-X

Version

• 3.6.0.0
• 3.6.0.1
• 3.6.0.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion