Debug Access Vulnerability in Growatt ShineLan-X Communication Dongle
CVE-2025-36753

8.6HIGH

Key Information:

Vendor

Growatt

Status
Shinelan-x
Vendor
CVE Published:
13 December 2025

What is CVE-2025-36753?

The Growatt ShineLan-X communication dongle contains a debug interface that is enabled by default, permitting unauthorized access to sensitive information. This vulnerability could allow an attacker to exploit the interface, gaining the ability to retrieve confidential data and manipulate device settings, posing significant risks to the security and integrity of the system.

Affected Version(s)

ShineLan-X 3.6.0.0 <= 3.6.0.2

References

https://csirt.divd.nl/CVE-2025-36753/
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hamid Rahmouni
Victor Pasman
JSON
.
CVE-2025-36753 : Debug Access Vulnerability in Growatt ShineLan-X Communication Dongle