Growatt Shine Lan-X Firmware
5 CVEs affecting Growatt Shine Lan-X Firmware. Latest disclosed: 2025-12-13. Critical: 3, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36753 | Critical | 9.8 | 2025-12-13 | The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and t… |
CVE-2025-36752 | Critical | 9.8 | 2025-12-13 | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, s… |
CVE-2025-36747 | Critical | 9.8 | 2025-12-13 | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser… |
CVE-2025-36750 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page vi… |
CVE-2025-36748 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the… |