Vulnerability · Published Dec 13, 2025 · Assigned by DIVD

CVE-2025-36754Authentication bypass on web interface

Critical 9.3

In plain English

A critical-severity authentication bypass by spoofing in ShineLan-X from Growatt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack.

Affected products (as reported)

Vendor	Product	Versions
Growatt	ShineLan-X	3.6.0.0 – through 3.6.0.2

Weakness: CWE-290 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

References

https://csirt.divd.nl/CVE-2025-36754/ third-party-advisory