Growatt Shinelan-X
7 CVEs affecting Growatt Shinelan-X. Latest disclosed: 2025-12-13. Critical: 3, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36753 | Critical | 9.8 | 2025-12-13 | The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and t… |
CVE-2025-36752 | Critical | 9.8 | 2025-12-13 | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, s… |
CVE-2025-36747 | Critical | 9.8 | 2025-12-13 | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser… |
CVE-2025-36750 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page vi… |
CVE-2025-36748 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the… |
CVE-2025-36754 | | 2025-12-13 | The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new s… | |
CVE-2025-36751 | | 2025-12-13 | Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept a… |