CVE-2025-36751: ShineLan-X 3.6.0.0 through 3.6.0.2

Affected technology

ShineLan-X · 3.6.0.0 through 3.6.0.2
Growatt

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

An attacker with access to the network can intercept and potentially manipulate communication requests between the inverter and its cloud endpoint. Vendor/CNA’s CVSS 4.0 assessment (base score 9.4/10) rates confidentiality, integrity and availability impact as high.