Missing Encryption Vulnerability in Growatt ShineLan-X and MIC 3300TL-X
CVE-2025-36751

9.4CRITICAL

Key Information:

Vendor

Growatt

Status
Shinelan-x
Vendor
CVE Published:
13 December 2025

What is CVE-2025-36751?

The Growatt ShineLan-X and MIC 3300TL-X products are susceptible to a security risk due to the absence of encryption in their configuration interface. This vulnerability permits an attacker with network access to intercept and potentially alter communication requests exchanged between the inverter and its associated cloud endpoint. Such exploitation could lead to unauthorized access or manipulation of device settings and data.

Affected Version(s)

ShineLan-X 3.6.0.0 <= 3.6.0.2

References

https://csirt.divd.nl/CVE-2025-36751/
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexandros Tokatlis
Victor Pasman
JSON
.
CVE-2025-36751 : Missing Encryption Vulnerability in Growatt ShineLan-X and MIC 3300TL-X