Insecure FTP Credentials in ShineLan-X Device Firmware

CVE-2025-36747

What is CVE-2025-36747?

The ShineLan-X firmware contains hardcoded credentials for FTP access, which can be exploited by attackers to establish an insecure connection. This vulnerability allows malicious actors to replace legitimate firmware files with their own unauthorized versions, as the signature verification for firmware updates is not enforced. As such, vulnerable devices may inadvertently deploy compromised firmware, leading to potential system breaches and data loss.

References