CVE-2025-36752 is an undocumented backdoor account (CWE-798, Use of Hard-coded Credentials) in the Growatt ShineLan-X communication dongle that monitors and connects Growatt solar inverters to the cloud: the dongle ships with a backup account and fixed, undocumented credentials that give an attacker significant-level access to the device, including its Setting Center, without needing the owner's own password, and NVD's own analysis rates the flaw 9.8 (critical) on CVSS v3.1.
Vulnerability summary
9.8
Critical
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2025-12-13
Published
Vulnerability ID: CVE-2025-36752 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Growatt ShineLan-X communication dongle (inverter Wi-Fi/network monitoring module) | — | Firmware >= 3.6.0.0 and < 3.6.0.2, per DIVD CSIRT coordinated-disclosure case CVE-2025-36752; patch available |
What does this mean for affected devices?
CVE-2025-36752 (CWE-798, Use of Hard-coded Credentials) affects the Growatt ShineLan-X communication dongle, the Wi-Fi/network module that connects Growatt string and hybrid solar inverters to the Growatt cloud monitoring platform. NVD's description states: "Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle" (NVD).
The flaw was found by Dutch non-profit coordinated-disclosure organization DIVD (Dutch Institute for Vulnerability Disclosure), credited to researcher Hamid Rahmouni (finder) and analyst Victor Pasman. DIVD's own advisory lists the affected range as ShineLan-X firmware ">= 3.6.0.0 to < 3.6.0.2" and scores the issue 9.4 (critical) on CVSS v4.0, vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, with attack vector "Adjacent" (reachable from the local network the dongle's Wi-Fi radio joins, rather than over the open internet) and a "Present" safety impact rating (DIVD CSIRT advisory). NVD's own Primary analysis rates the same flaw 9.8 (critical) on CVSS v3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — treating it as network-reachable rather than adjacency-only.
Because the backdoor account's credentials are undocumented and fixed across every device running the affected firmware, an attacker who reaches one ShineLan-X dongle (for example on a shared installer network, an improperly segmented home Wi-Fi, or a misconfigured public-facing deployment) effectively has the same access on every other ShineLan-X dongle still on vulnerable firmware, including the Setting Center used to reconfigure the inverter's grid and communication parameters.
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0032 (25.0th percentile) as of 2026-11-08 — a low score typical of a flaw disclosed through coordinated research rather than observed in the wild (CISA KEV, FIRST EPSS).
Operators of Growatt inverters fitted with a ShineLan-X dongle should update to firmware 3.6.0.2 or later, and in the meantime should not expose the dongle's Wi-Fi access point or local network interface to untrusted users or networks.
Evidence
- Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials allowing significant-level access, including the Setting Center; effectively a backdoor for all devices using a ShineLan-X dongle. — NVD
- Affected firmware range >= 3.6.0.0 and < 3.6.0.2; found by Hamid Rahmouni (finder) and Victor Pasman (analyst) at DIVD; DIVD's own CVSS v4.0 score is 9.4 (critical), attack vector Adjacent, vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. — DIVD CSIRT advisory
- NVD's own Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0032 (25.0th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What does the backdoor account in CVE-2025-36752 actually give an attacker?
The ShineLan-X dongle ships with an undocumented backup account protected by undocumented, fixed credentials, giving any attacker who can reach the device significant-level access, including the inverter's Setting Center used to reconfigure grid and communication parameters — NVD describes this as 'effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle' (per NVD).
Which ShineLan-X firmware versions are vulnerable, and is a fix available?
DIVD's advisory lists the affected range as firmware >= 3.6.0.0 and < 3.6.0.2; operators should update to firmware 3.6.0.2 or later (per DIVD CSIRT advisory).
Why do DIVD and NVD rate this vulnerability's severity differently?
DIVD, which found and coordinated the issue, scores it 9.4 (critical) on CVSS v4.0 with attack vector 'Adjacent' — reachable from the local network the dongle's Wi-Fi radio joins rather than the open internet; NVD's own Primary analysis rates it 9.8 (critical) on CVSS v3.1 with a network attack vector (per DIVD CSIRT advisory; per NVD).
Is CVE-2025-36752 being exploited in the wild, and how should operators respond?
It is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST's EPSS model scores the exploitation probability at 0.0032 (25.0th percentile) as of 2026-11-08 — a low score typical of coordinated research disclosure rather than in-the-wild discovery; operators should update firmware and avoid exposing the dongle's Wi-Fi access point or local network interface to untrusted users (per CISA KEV; per FIRST EPSS).