Growatt ShineLan-X CVE-2025-36747

Exploitation requires network adjacency to the ShineLan-X FTP service (CVSS AV:A - same LAN/broadcast domain or deployment network, not arbitrary internet reach), plus possession of the FTP credentials hard-coded in the firmware, which an attacker recovers by extracting and inspecting the firmware image. The critical enabling condition is that firmware/file signature verification is not enforced, so substituted files are accepted; if signature enforcement were present or the FTP service were network-isolated, the file-replacement impact would be neutralized. No end-user interaction or prior authenticated account is needed since the credentials are static and attacker-knowable, but the adjacent-network requirement meaningfully limits remote mass exploitation.

This is a genuine high-priority issue despite an unremarkable EPSS score. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact on both the vulnerable system and subsequent systems (VC/VI/VA:H, SC/SI/SA:H), reflecting that a compromised firmware-distribution path cascades to deployed devices. The root cause, hard-coded FTP credentials embedded in firmware (CWE-798), combined with firmware signature verification not being enforced, means the integrity impact is the dominant concern - an attacker can substitute malicious firmware/files. Signals partially conflict: EPSS is low (0.32%, 23rd percentile) and there is no CISA KEV listing and no identified public exploit, yet the vulnerability was found and reported by DIVD CSIRT (a credible coordinated-disclosure body), and hardcoded credentials recoverable from firmware are trivially reusable once published. The low EPSS likely reflects the adjacent-network (AV:A, not AV:N) requirement and the embedded/IoT nature of the target rather than low severity. Note the vector is 4.0-only; no CVSS 3.1 vector was supplied in the input, and the 'Authentication Bypass' tag is imprecise for what is fundamentally a hardcoded-credentials weakness.

An attacker with access to the same local/adjacent network segment as the ShineLan-X device (or its deployment infrastructure) extracts the hard-coded FTP credentials from publicly obtainable firmware, then authenticates to the FTP server. Because firmware signature verification is not enforced, the attacker replaces legitimate files staged for deployment with malicious versions, which are then pushed to downstream devices. No public exploit code has been identified at time of analysis, but credential extraction from firmware is low-effort.