ShineLan-X CVE-2025-36750

Exploitation requires an authenticated account on the ShineLan-X management web interface (CVSS PR:L) with the ability to create or edit a plant and submit the Plant Name field via a direct POST. Execution is triggered only when a legitimate user subsequently views the plant management page where the stored payload renders, so impact depends on another user with access to that device opening that page. Limiting factors: attacker needs valid low-privilege credentials/access to the device UI, exploitation is confined to users of that specific datalogger instance, and realistic impact is browser-context script execution (session/token theft, UI actions) rather than direct device code execution.

Signals are consistently moderate rather than critical. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L), scoring 8.6 - but that score looks inflated for a stored XSS, as it asserts high confidentiality impact (VC:H) plus high subsequent-system impact across SC/SI/SA, which is aggressive for reflected script execution in a victim's browser. EPSS is low at 0.16% (5th percentile), indicating no meaningful mass-exploitation pressure. The vulnerability is NOT in CISA KEV and no public exploit is identified in the provided data, so exploitation status is: no public exploit identified at time of analysis. Net assessment: this is a real but lower-tier issue - a classic authenticated stored XSS in an IoT/solar datalogger admin interface - not a widespread emergency. The gap between the vendor's 8.6 and the low EPSS/absent-KEV reality should be reconciled before high-priority patching; CWE-79 stored XSS requiring an authenticated account to inject is the limiting factor.

An attacker with low-privilege access to the Growatt ShineLan-X web interface submits a malicious HTML/JavaScript payload in the Plant Name field via a direct POST. When a legitimate user (e.g. an administrator) later opens the plant management page, the stored payload executes in their browser, enabling session/token theft or actions in the victim's context. No public exploit code is identified at time of analysis.