BaseFortify

Publication date: 2025-12-13

Last updated on: 2026-01-14

Assigner: Dutch Institute for Vulnerability Disclosure

Description

The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-13

Last Modified

2026-01-14

Generated

2026-07-06

AI Q&A

2025-12-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36753

Affected Vendors & Products

Vendor	Product	Version / Range
growatt	shine_lan-x_firmware	From 3.6.0.0 (inc) to 3.6.0.2 (exc)
growatt	shine_lan-x	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

The vulnerability involves the SWD debug interface on the Growatt ShineLan-X communication dongle being enabled by default. This allows an attacker to gain debug access to the device and extract secrets or domain information stored within it.

Impact Analysis

An attacker exploiting this vulnerability could gain unauthorized debug access to the device, potentially extracting sensitive secrets or domain information. This could lead to compromise of device security, unauthorized control, or leakage of confidential data.

Hi! I’m here to help you understand CVE-2025-36753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70