What’s Vulnerable › Vulnerabilities
CVE-2025-36747: Hardcoded FTP Credentials within the firmware
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-13 · updated 2026-10-07
- Weakness: CWE-798
Description
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced.
Affected products
- Growatt ShineLan-X: from 3.6.0.0 before 3.6.0.2 — fixed in 3.6.0.2
How to fix
Upgrade to a fixed version: Growatt ShineLan-X 3.6.0.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-36747 or the next vulnerability affects your stack