Growatt ShineLan-X CVE-2025-36753

Exploitation requires PHYSICAL access to the Growatt ShineLan-X dongle and the presence of the on-board SWD (Serial Wire Debug) interface, which the description states is available/enabled by default - no debug lock or authentication is applied in the default configuration. The concrete prerequisite is the attacker attaching a hardware debug probe to the SWD pins to halt the MCU and read device memory. The primary limiting factor is the physical-access requirement (AV:P): the attack does not scale remotely and cannot be performed over the network, so risk concentrates on dongles in physically reachable or exposed installations; no authentication or user interaction is otherwise needed once physical access is obtained.

This is a high-CVSS (8.6, CVSS 4.0) but constrained-real-risk issue once the attack vector is weighed. The CVSS vector is explicit that exploitation requires PHYSICAL access (AV:P) with low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N), yielding full confidentiality/integrity/availability impact on both the vulnerable and subsequent systems (VC/VI/VA:H and SC/SI/SA:H - a scope change). The signals are internally consistent and point to a localized, hands-on hardware attack rather than a scalable remote threat: EPSS is low (0.32%, 23th percentile), the CVE is NOT on CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The physical requirement is the dominant mitigating factor: an attacker must possess or reach the dongle to attach to the SWD debug pins, which caps mass exploitability. Net priority: this matters most for devices in physically exposed or attacker-reachable installations (where secrets/domains extracted could enable follow-on cloud/account compromise), but it is not a drop-everything remote-RCE emergency. No conflicting signals were found between the CVSS vector and the description - both agree on physical/hardware access.

An attacker with brief physical access to a deployed Growatt ShineLan-X dongle attaches a debug probe to the exposed, default-enabled SWD interface, halts the microcontroller, and reads out firmware and memory to extract embedded secrets (credentials, keys) and backend domains. No public exploit code is referenced, but the attack is low-complexity for anyone with standard embedded-debug tooling; recovered secrets could then be reused against the vendor cloud or other dongles.