CVE-2025-36751

CriticalCVSS 9.4/10Last modified Oct 7, 2026

Description

Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
Growatt	ShineLan-X	>= 3.6.0.0, <= 3.6.0.2

References

https://csirt.divd.nl/CVE-2025-36751/

Timeline

Published: Dec 13, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-367529.8Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level acce CVE-2025-367539.8The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access CVE-2025-367549.3The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post CVE-2025-367552.4The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating co CVE-2025-367565.8A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is CVE-2025-367576.3It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen CVE-2025-367586.3It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality CVE-2025-367598.7Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user em CVE-2025-36769.8A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/searc CVE-2025-36775.3A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_CVE-2025-36789.8A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of t CVE-2025-36799.8A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component HOS