CVE-2025-36747

CRITICAL

Growatt Shine Lan-x Firmware < 3.6.0.2 - Hard-coded Credentials

Title source: rule

Description

ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced.

References (1)

[Third Party Advisory] https://csirt.divd.nl/CVE-2025-36747/

Scores

CVSS v3 9.8

EPSS 0.0007

EPSS Percentile 22.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-798

Status published

Products (1)

growatt/shine_lan-x_firmware 3.6.0.0 - 3.6.0.2

Published Dec 13, 2025

Tracked Since Feb 18, 2026