CVE-2025-36752 - Undocumented backup Account and No Password Configuration Capability · CoreCVE

Back Back to CVE browser

CRITICAL

Undocumented backup Account and No Password Configuration Capability

Published Dec 13, 2025

9.4

CRITICAL

CVSS 4.0

EPSS 0.32%

Description

Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.

Affected products

Vendor Growatt Product ShineLan-X Default
unaffected
Affected
- ≥ 3.6.0.0, ≤ 3.6.0.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Growatt	ShineLan-X	unaffected	Affected ≥ 3.6.0.0, ≤ 3.6.0.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

https://csirt.divd.nl/CVE-2025-36752/
third-party-advisoryThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203251
Advisory

Link	Providers	Tags
https://csirt.divd.nl/CVE-2025-36752/		third-party-advisoryThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203251		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner DIVD

Published Dec 13, 2025

Updated Jan 7, 2026

Reserved Apr 15, 2025

Link CVE-2025-36752

CISA Vulnrichment

Updated Dec 15, 2025

NVD

Status Analyzed

Modified Oct 7, 2026

Link CVE-2025-36752

Red Hat

No data

ENISA EUVD

Assigner DIVD

Published Dec 13, 2025

Updated Jan 7, 2026

Link EUVD-2025-203251

GitHub

No data