CVE-2025-36747criticalCWE-798

CVE-2025-36747: falha crítica em Growatt ShineLan-X

Hardcoded FTP Credentials within the firmware

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ShineLan-X

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.3%
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Growatt · ShineLan-X
CVEs relacionadas — Growatt ShineLan-X

No mesmo produto, das mais perigosas para as menos.

CVE-2025-36752CRITICALUndocumented backup Account and No Password Configuration CapabilityEPSS 0.3%CVE-2025-36753HIGHSWD Interface Open on Growatt ShineLan-XEPSS 0.3%CVE-2025-36754CRITICALAuthentication bypass on web interfaceEPSS 0.2%CVE-2025-36750HIGHStored cross site scripting (XSS) vulnerability in Growatt ShineLan-XEPSS 0.2%CVE-2025-36748HIGHStored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-XEPSS 0.2%CVE-2025-36751CRITICALMissing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-XEPSS 0.1%