CVE-2025-36747 is a Critical flaw, scored CVSS 9.8, in Growatt ShineLan-X firmware 3.6.0.0 up to 3.6.0.2. Hardcoded FTP credentials sit in the firmware, and firmware signatures are not enforced. DIVD's advisory is the main source, so confirm the fixed firmware with Growatt.
What's affected
DIVD CSIRT, the coordinated disclosure team that published the advisory, lists Growatt ShineLan-X firmware from 3.6.0.0 up to but not including 3.6.0.2 as affected, and everything else as unaffected. That implies 3.6.0.2 or later carries the fix. The ShineLan-X is a communication dongle that connects Growatt solar inverters to the vendor's cloud.
I did not find a vendor advisory in the sources. Confirm the fixed firmware with Growatt or your installer.
How to check if you're exposed
Find the firmware version of each ShineLan-X dongle. It is shown in the device's own settings page or in the Growatt monitoring service, depending on how it was installed. Compare it with the affected range of 3.6.0.0 up to but not including 3.6.0.2.
Also work out where the dongles sit. Many are on a home or business network with no one watching them, so ask your installer for a list if you manage solar sites for others.
What to do now
- Inventory ShineLan-X dongles and their firmware versions.
- Ask Growatt or your installer for the firmware that fixes this CVE and update affected dongles. DIVD's range suggests 3.6.0.2 or later.
- Treat any FTP traffic from the dongle as untrusted until it is updated, and do not reuse the credential anywhere.
- Keep the dongle off networks that hold other sensitive systems, and block inbound access to it from the internet.
- Watch for the vendor advisory and re-check after updating.
Why it matters
The weakness is CWE-798 (Use of Hard-coded Credentials). A credential for an FTP server is baked into the firmware. Anyone who extracts the firmware gets the same credential as every other owner, so it cannot be kept secret.
The record adds the part that raises the stakes. Firmware signature verification is not enforced, so an attacker with that FTP access could replace files that are meant to be deployed to devices with their own. That turns a leaked password into a route to push altered code to devices.
The record scores it 9.8, network, no privileges, no interaction. DIVD publishes its own CVSS v4 style score of 9.4 and marks a safety impact as present. The record does not mark the CVE as exploited. The same advisory team also published CVE-2025-36752 and CVE-2025-36753 for this dongle, so review all three together.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the real risk?
A shared credential plus missing signature checks means someone with access to the FTP service could swap in their own files for devices to run.
Which firmware is safe?
DIVD lists 3.6.0.0 up to but not including 3.6.0.2 as affected. Confirm the fixed build with Growatt.
Sources
Last reviewed: 18 October 2026.
