CVE-2025-36745 is a weakness in the SolarEdge SE3680H solar inverter (CWE-1104, Use of Unmaintained Third Party Components, per the coordinating researchers): the device ships with an outdated Linux kernel carrying unpatched vulnerabilities in core subsystems, so an attacker with network or local access to the inverter can chain those underlying kernel flaws into code execution, privilege escalation or disclosure of sensitive information, and NVD's own analysis rates the flaw 7.8 (high) on CVSS v3.1.
Vulnerability summary
7.8
High
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2025-12-12
Published
Vulnerability ID: CVE-2025-36745 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| SolarEdge SE3680H (residential/C&I solar inverter firmware and its bundled Linux OS) | — | Firmware >= 4.0 and < 4.22, per DIVD CSIRT coordinated-disclosure case DIVD-2025-00022; fix (security patch) available |
What does this mean for affected devices?
CVE-2025-36745 affects the SolarEdge SE3680H solar inverter. NVD's description states: "SolarEdge SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems. An attacker with network or local access can exploit these flaws to achieve remote code execution, privilege escalation, or disclosure of sensitive information" (NVD). NVD lists the weakness only as NVD-CWE-noinfo (insufficient detail to assign a specific CWE), but the coordinating researchers classify it as CWE-1104, Use of Unmaintained Third Party Components.
The issue was coordinated by DIVD (Dutch Institute for Vulnerability Disclosure) as part of case DIVD-2025-00022, "SolarEdge SE3680H and SolarEdge Monitoring Platform vulnerabilities," credited to researchers Hamid Rahmouni, Alexandros Tokatlis and Akram Hamdi, with Victor Pasman as case lead. DIVD's case summary groups this with two other SE3680H firmware issues disclosed in the same round — an exposed debug/test interface (CVE-2025-36743) and bootloader-loop diagnostic information exposure (CVE-2025-36744) — plus an unrelated cross-site scripting issue in the separate SolarEdge Monitoring Platform SaaS product (CVE-2025-36746). DIVD's own disclosure timeline records the process starting 18 June 2025, feedback from SolarEdge resolved and additional information shared 21 September 2025, disclosure timing agreed 4 December 2025, and the CVE records published 18 December 2025; DIVD records patch status as "Available" (DIVD CSIRT case DIVD-2025-00022).
DIVD's own CVSS v4.0 score for this specific issue is 7.0, vector CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L, with attack vector "Physical" — reflecting that the other two SE3680H issues in the same case are chained from physical access to the inverter's debug interface. NVD's own Primary analysis instead rates the vulnerability 7.8 (high) on CVSS v3.1, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (local attack vector, low privileges required) (NVD; DIVD CSIRT advisory).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0023 (13.9th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
A security patch is available from SolarEdge. Operators of SE3680H inverters on firmware older than 4.22 should apply it, and should not treat the device's debug-adjacent interfaces as safe to expose even on a trusted installer network, since the underlying kernel flaws this issue references can be reached once any kind of local or network access is obtained.
Evidence
- SolarEdge SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems; an attacker with network or local access can exploit these flaws to achieve remote code execution, privilege escalation, or disclosure of sensitive information. — NVD
- Coordinated by DIVD as case DIVD-2025-00022, credited to Hamid Rahmouni, Alexandros Tokatlis and Akram Hamdi (case lead Victor Pasman); grouped with CVE-2025-36743, CVE-2025-36744 (same device) and CVE-2025-36746 (SolarEdge Monitoring Platform); disclosure started 18 Jun 2025, CVE records published 18 Dec 2025; patch status Available. — DIVD CSIRT case DIVD-2025-00022
- DIVD's own CVSS v4.0 score is 7.0, vector CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L; NVD's own Primary CVSS v3.1 score is 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0023 (13.9th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What is the actual weakness behind CVE-2025-36745, and what can an attacker do with it?
The SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems; an attacker with network or local access to the inverter can chain those underlying kernel flaws into remote code execution, privilege escalation, or disclosure of sensitive information (per NVD).
Why do DIVD and NVD score this vulnerability so differently?
DIVD, the coordinating researchers, rate it 7.0 on CVSS v4.0 with attack vector 'Physical' (CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L), reflecting that the companion SE3680H issues in the same case are chained from physical access to a debug interface; NVD's own Primary analysis instead rates it 7.8 (high) on CVSS v3.1 with a local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (per NVD; per DIVD CSIRT advisory).
Is this related to other SolarEdge SE3680H vulnerabilities?
Yes, DIVD's case DIVD-2025-00022 also covers an exposed debug/test interface (CVE-2025-36743) and bootloader-loop diagnostic information exposure (CVE-2025-36744) on the same device, plus an unrelated cross-site scripting issue in the separate SolarEdge Monitoring Platform SaaS product (CVE-2025-36746) (per DIVD CSIRT case DIVD-2025-00022).
Is a fix available, and is CVE-2025-36745 being exploited in the wild?
DIVD records the patch status as 'Available,' and operators on firmware older than 4.22 should apply it; the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST's EPSS model scores the exploitation probability at 0.0023 (13.9th percentile) as of 2026-11-08 (per DIVD CSIRT case DIVD-2025-00022; per CISA KEV; per FIRST EPSS).