CVE-2025-36753
BaseFortify
Publication date: 2025-12-13
Last updated on: 2026-01-14
Assigner: Dutch Institute for Vulnerability Disclosure
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| growatt | shine_lan-x_firmware | From 3.6.0.0 (inc) to 3.6.0.2 (exc) |
| growatt | shine_lan-x | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability involves the SWD debug interface on the Growatt ShineLan-X communication dongle being enabled by default. This allows an attacker to gain debug access to the device and extract secrets or domain information stored within it.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could gain unauthorized debug access to the device, potentially extracting sensitive secrets or domain information. This could lead to compromise of device security, unauthorized control, or leakage of confidential data.