Growatt ShineLan-X CVE-2025-36751

Exploitation requires the attacker to hold an adjacent-network position (AV:A) - on the same LAN/Wi-Fi segment as the Growatt ShineLan-X communication module or MIC 3300TL-X inverter - and to be able to observe or intercept the traffic path between the inverter and its cloud endpoint (e.g., via an on-path/MITM technique such as ARP spoofing). The enabling condition is architectural rather than configuration-specific: the configuration interface transmits data without encryption (CWE-311), so no special feature toggle is needed, but exploitation is LIMITED by the requirement for local/adjacent network access (not routable internet exploitation), by the need for an on-path position to do more than passively eavesdrop, and by the description's hedged 'potentially manipulate' - active tampering is plausible but not confirmed as a reliable primitive.

Signals are mixed and point to a serious-but-position-limited flaw rather than a mass-exploitation emergency. The input CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N with full Vulnerable- and Subsequent-system Confidentiality/Integrity/Availability High) drives the 9.4 critical score, but the AV:A metric is the key limiter: this is adjacent-network, not internet-wide (AV:N), so an attacker must already share the local network segment with the inverter or its ShineLan-X communication dongle. The EPSS score is very low (0.07%, 0th percentile), the CVE is NOT in CISA KEV, and no public exploit is identified - all three low-signal indicators are consistent with each other and with a missing-encryption/MITM class issue (CWE-311) that requires an on-path network position rather than a point-and-click remote exploit. CONFLICT TO NOTE: the input vector marks subsequent-system impact High (SC:H/SI:H/SA:H) and availability High (VA:H), which seems aggressive for a flaw the description only characterizes as allowing an attacker to 'intercept and potentially manipulate' cloud communication - the word 'potentially' and the absence of any described code-execution or device-takeover primitive suggest integrity/availability impact is speculative and may be overstated; verify with the DIVD/vendor advisory. Net: treat as a real priority for networks where these inverters sit on untrusted/shared LANs (solar installations, shared OT segments), but it is not a drop-everything internet-facing threat.

An attacker who gains a foothold on the same local or Wi-Fi network as a Growatt ShineLan-X module or MIC 3300TL-X inverter positions themselves on-path (e.g., via ARP spoofing) and passively captures the unencrypted configuration/cloud traffic, exposing operational and potentially credential data. Because the channel lacks encryption and integrity protection, the attacker can then attempt to alter the requests flowing between the inverter and its cloud endpoint. No public proof-of-concept exploit is known at the time of analysis, and exploitation requires adjacent-network access rather than remote internet reach.