What’s Vulnerable › Vulnerabilities

CVE-2025-36756: Device Takeover vulnerability in SolaX Cloud

• Severity: medium (CVSS 5.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-10 · updated 2026-06-17
• Weakness: CWE-306

Description

A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known.

Affected products

• SolaX Power SolaX Cloud: before 27-06-2025

References

• https://csirt.divd.nl/CVE-2025-36756
• https://csirt.divd.nl/DIVD-2025-00015

Get alerted when CVE-2025-36756 or the next vulnerability affects your stack