CVE-2025-36747
criticalShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser…
Vendor / product: Growatt — shine lan-x firmware
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-12-13 16:16
Modified: 2026-10-07 19:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
growatt / shine_lan-x_firmware ≥3.6.0.0 <3.6.0.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://csirt.divd.nl/CVE-2025-36747/ csirt@divd.nl
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗