Vulnerability · Published Dec 13, 2025 · Assigned by DIVD
CVE-2025-36747Hardcoded FTP Credentials within the firmware
Critical 9.4
In plain English
A critical-severity hard-coded credentials in ShineLan-X from Growatt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Growatt | ShineLan-X | 3.6.0.0 – through 3.6.0.2 |
Weakness: CWE-798 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://csirt.divd.nl/CVE-2025-36747/ third-party-advisory