CVE-2025-36751
Unencrypted Configuration Interface in Growatt Inverters Enables MITM
Publication date: 2025-12-13
Last updated on: 2025-12-13
Assigner: Dutch Institute for Vulnerability Disclosure
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| growatt | mic_3300tl-x | * |
| growatt | shine_lan-x | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-311 | The product does not encrypt sensitive or critical information before storage or transmission. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to missing encryption on the configuration interface of Growatt ShineLan-X and MIC 3300TL-X devices. Because of this, an attacker who has access to the network can intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
How can this vulnerability impact me? :
The vulnerability allows an attacker on the same network to intercept sensitive communication and potentially manipulate the data exchanged between the inverter and its cloud endpoint. This can lead to unauthorized control, data tampering, or disruption of the inverter's operation.