CVE-2025-36744

LowCVSS 2.4/10Last modified Oct 7, 2026

Description

SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initializes and waits for boot instructions, the bootloader emits diagnostic output this behavior can leak operating system information.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-367457.8SolarEdge SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems. An attacker with network or CVE-2025-367465.4SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report na CVE-2025-367479.8ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP conn CVE-2025-367485.4ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can CVE-2025-36755.3A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function se CVE-2025-367505.4ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant CVE-2025-367519.4Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the net CVE-2025-367529.8Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level acce CVE-2025-367539.8The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access CVE-2025-367549.3The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post CVE-2025-367552.4The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating co CVE-2025-367565.8A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is