CVE-2025-36753
Analyzed Analyzed - Analysis Complete
BaseFortify

Publication date: 2025-12-13

Last updated on: 2026-01-14

Assigner: Dutch Institute for Vulnerability Disclosure

Description
The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-13
Last Modified
2026-01-14
Generated
2026-06-16
AI Q&A
2025-12-13
EPSS Evaluated
2026-06-15
NVD
CVE-2025-36753
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
growatt shine_lan-x_firmware From 3.6.0.0 (inc) to 3.6.0.2 (exc)
growatt shine_lan-x *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability involves the SWD debug interface on the Growatt ShineLan-X communication dongle being enabled by default. This allows an attacker to gain debug access to the device and extract secrets or domain information stored within it.

Impact Analysis

An attacker exploiting this vulnerability could gain unauthorized debug access to the device, potentially extracting sensitive secrets or domain information. This could lead to compromise of device security, unauthorized control, or leakage of confidential data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-36753. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart