Growatt ShineLan-X CVE-2025-36752

Exploitation requires (1) network adjacency to a Growatt ShineLan-X dongle - the CVSS AV:A vector means the attacker must reside on the same local/adjacent network segment (LAN, Wi-Fi, or linked VLAN), not the open Internet by default - and (2) use of the device's undocumented backup account and its undocumented/hardcoded credentials to reach the Setting Center. No special non-default configuration or user interaction is needed (UI:N) and no legitimate account is required (PR:N), because the backdoor account is built into the firmware; the credentials themselves are the enabling 'feature.' The primary limiting factor is the adjacent (non-remote) attack vector: devices isolated on segmented networks or not exposed to attacker-reachable segments are not exploitable over the Internet.

This is a genuine high-priority issue, not merely an inflated CVSS score. The core weakness is CWE-798 (hardcoded/undocumented backdoor credentials) in the Growatt ShineLan-X dongle, giving any attacker access to the device's Setting Center with full confidentiality, integrity and availability impact (VC:H/VI:H/VA:H). The decisive mitigating signal is the attack vector: the supplied CVSS 4.0 vector is AV:A (adjacent network), AC:L, PR:N, UI:N - meaning exploitation requires presence on the same local/adjacent network segment rather than direct Internet reachability, which substantially narrows the exploitable population compared to a true AV:N backdoor. The signals are somewhat conflicting: the 9.4 CVSS 4.0 score (driven partly by SC/SI/SA:H subsequent-system impact) reflects maximal technical severity, yet EPSS is only 0.32% (23rd percentile), indicating low modeled near-term mass-exploitation probability - consistent with an adjacent-vector flaw disclosed by a CSIRT (DIVD) rather than one seen in broad opportunistic campaigns. There is no CISA KEV listing and no public exploit code identified in the provided data, so this is no public exploit identified at time of analysis. Net: a critical-by-design backdoor whose real-world risk is gated by network adjacency and whose low EPSS/absence of KEV suggests it is not yet widely weaponized - remediate promptly on exposed or flat networks, but the AV:A constraint means it is not an Internet-wide drive-by.

An attacker who gains a foothold on the same local network as a Growatt ShineLan-X dongle (e.g., via the residential/industrial LAN, Wi-Fi, or an adjacent VLAN) authenticates to the device using the undocumented backup account's hardcoded credentials and reaches the Setting Center. From there they can read and alter device configuration, disrupt solar monitoring/control, or pivot. No public proof-of-concept is identified in the provided data, and the CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N) indicates low-complexity, no-interaction abuse once network adjacency is achieved.