What’s Vulnerable › Vulnerabilities
CVE-2025-36751: Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X
- Severity: critical (CVSS 9.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-13 · updated 2026-10-07
- Weakness: CWE-311
Description
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
Affected products
- Growatt ShineLan-X: from 3.6.0.0 through 3.6.0.2
References
Get alerted when CVE-2025-36751 or the next vulnerability affects your stack