Growatt ShineLAN-X CVE-2025-36748

Attacker must have low-privileged authenticated access to the Shine LAN-X local configuration web server and the ability to reach the communication module's 'settings center', where an unsanitized input field permits insertion of a stored JavaScript snippet (CWE-79). Payload execution then requires a legitimate user - typically a higher-privileged administrator - to subsequently view the affected settings page, so a victim-interaction step gates impact despite the input vector's UI:N. Additional limiting factors: the vulnerable interface is the device's local configuration web server, generally exposed only on the local/management LAN rather than the public internet, and an existing (low-level) credential or session on that interface is a prerequisite.

Signals point to a real but non-urgent issue rather than a top-priority emergency. The vendor/CSIRT CVSS 4.0 base score is 8.4 (high), driven by VC:H and a scope change (SC:H) because injected script executes in a legitimate user's browser context. However, the vector itself tempers this: PR:L means an attacker must already hold a (low-privileged) authenticated session on the device's local configuration web server, so this is not a fully unauthenticated internet-facing bug. Exploitation-likelihood signals are weak: EPSS is only 0.16% (4th percentile), there is NO CISA KEV listing, and NO public exploit code is referenced - so there is no public exploit identified at time of analysis. CONFLICT TO VERIFY: the input vector states UI:N, but a stored XSS of this type realistically requires a legitimate user to load the affected settings page for the payload to fire, which argues for user interaction (UI:P in 4.0 / UI:R in 3.1); this discrepancy inflates the base score and should be verified with the DIVD/vendor advisory. Net: a credible privilege-escalation/session-compromise vector inside the device management plane, but gated by prior authentication and victim interaction, and with no evidence of active or automated exploitation - treat as a scheduled-patch item, not an emergency.

An attacker with low-privileged access to the Growatt Shine LAN-X local configuration web server inserts a malicious JavaScript snippet into the communication module's settings center, where it is stored persistently. When a higher-privileged legitimate user (e.g., an administrator) later opens that settings page, their browser executes the attacker's script, enabling session/token theft or configuration actions performed as that user. No public exploit code is referenced, and the attack is network-reachable (AV:N) but typically confined to the local/management network hosting the device's config server.