CVE-2025-36752 is a Critical flaw, scored CVSS 9.8, in the Growatt ShineLan-X communication dongle. An undocumented backup account with undocumented credentials gives access to the Setting Center. DIVD lists firmware 3.6.0.0 up to 3.6.0.2 as affected, so update and confirm the fix with Growatt.
What's affected
DIVD CSIRT, the coordinated disclosure team that published the advisory, lists Growatt ShineLan-X firmware from 3.6.0.0 up to but not including 3.6.0.2 as affected, and everything else as unaffected. That implies 3.6.0.2 or later carries the fix. The ShineLan-X is a communication dongle that connects Growatt solar inverters to the vendor's cloud.
I did not find a vendor advisory in the sources. Confirm the fixed firmware with Growatt or your installer.
How to check if you're exposed
Find the firmware version of each ShineLan-X dongle. It is shown in the device's own settings page or in the Growatt monitoring service, depending on how it was installed. Compare it with the affected range of 3.6.0.0 up to but not including 3.6.0.2.
Also work out where the dongles sit. Many are on a home or business network with no one watching them, so ask your installer for a list if you manage solar sites for others.
DIVD describes the attack vector as adjacent, meaning the attacker needs to be on the same network segment. The record's own score treats it as network reachable. Plan for the worse case if the device can be reached from the internet.
What to do now
- Inventory ShineLan-X dongles and their firmware versions.
- Ask Growatt or your installer for the firmware that fixes this CVE and update affected dongles. DIVD's range suggests 3.6.0.2 or later.
- Block access to the dongle's web interface from anything other than a trusted management host.
- Keep the dongle off networks that hold other sensitive systems, and block inbound access to it from the internet.
- Watch for the vendor advisory and re-check after updating.
Why it matters
The weakness is CWE-798 (Use of Hard-coded Credentials). The firmware contains an account that is not documented and whose credentials cannot be changed by the owner, which DIVD describes as a no password configuration capability. The description in the record calls it effectively a backdoor for every device using the dongle.
Access to the Setting Center means the attacker can change device settings. For a dongle that relays data and settings for a solar inverter, that can affect monitoring and, depending on the setup, the way the system is run. DIVD marks a safety impact as present in its own scoring.
The two scores differ. The record has 9.8 with a network vector. DIVD gives 9.4 with an adjacent vector. Both are critical. The record does not flag exploitation in the wild.
Quick check
Can I change the password to fix it?
The advisory describes an undocumented account with credentials the owner does not control, so a firmware update is the fix, not a password change.
Why do the scores differ?
The record uses a network vector for 9.8. DIVD lists an adjacent vector and a 9.4 score. Both rate it Critical.
Sources
Last reviewed: 18 October 2026.
