CVE-2025-36753 is a Critical flaw in the record, CVSS 9.8, where the SWD debug interface on the Growatt ShineLan-X dongle is available by default. That lets an attacker extract secrets from the device. DIVD lists firmware 3.6.0.0 up to 3.6.0.2 as affected and rates it 8.6 with a physical vector.
What's affected
DIVD CSIRT, the coordinated disclosure team that published the advisory, lists Growatt ShineLan-X firmware from 3.6.0.0 up to but not including 3.6.0.2 as affected, and everything else as unaffected. That implies 3.6.0.2 or later carries the fix. The ShineLan-X is a communication dongle that connects Growatt solar inverters to the vendor's cloud.
I did not find a vendor advisory in the sources. Confirm the fixed firmware with Growatt or your installer.
How to check if you're exposed
Find the firmware version of each ShineLan-X dongle. It is shown in the device's own settings page or in the Growatt monitoring service, depending on how it was installed. Compare it with the affected range of 3.6.0.0 up to but not including 3.6.0.2.
Also work out where the dongles sit. Many are on a home or business network with no one watching them, so ask your installer for a list if you manage solar sites for others.
This one differs from its two sibling CVEs because DIVD sets the attack vector to physical. Exposure depends on who can touch the device. Dongles in shared or public spaces, or installed by third parties at customer sites, deserve attention first.
What to do now
- Inventory ShineLan-X dongles and their firmware versions.
- Ask Growatt or your installer for the firmware that fixes this CVE and update affected dongles. DIVD's range suggests 3.6.0.2 or later.
- Record where each dongle is installed and who has physical access to it. Move or secure the ones in open areas.
- Keep the dongle off networks that hold other sensitive systems, and block inbound access to it from the internet.
- Watch for the vendor advisory and re-check after updating.
Why it matters
The weakness is CWE-290 (Authentication Bypass by Spoofing). The debug interface is enabled by default, so anyone who can connect to its pins can get debug access. DIVD describes extraction of secrets or domains from within the device as the result.
Secrets pulled from one dongle matter more when other flaws exist. The sibling CVEs describe hardcoded credentials and an undocumented account, so what is read from a device in hand may help in attacks over the network. That link is my inference, not a statement in the advisory.
The score gap is worth noting. The record shows 9.8. DIVD scores it 8.6 High with a physical vector. If your dongles are not physically reachable, your real risk is lower than the number suggests. The record does not flag exploitation.
Quick check
Can this be exploited remotely?
The DIVD advisory sets the attack vector to physical, which means hardware access to the device. The record scores it as network. Read both when you judge risk.
What fixes it?
A firmware update that disables or protects the debug interface. Confirm the fixed build with Growatt.
Sources
Last reviewed: 18 October 2026.
