CVE-2025-36750: falha de alta gravidade em Growatt ShineLan-X
Stored cross site scripting (XSS) vulnerability in Growatt ShineLan-X
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.2%
probabilidade de exploração
0.2%top 95% das CVEs
exploração observada
nãonenhuma fonte reporta
ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via a direct post. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:H/SA:H
Produtos afetados
Growatt · ShineLan-XCVEs relacionadas — Growatt ShineLan-X
No mesmo produto, das mais perigosas para as menos.
CVE-2025-36747CRITICALHardcoded FTP Credentials within the firmwareEPSS 0.3%CVE-2025-36752CRITICALUndocumented backup Account and No Password Configuration CapabilityEPSS 0.3%CVE-2025-36753HIGHSWD Interface Open on Growatt ShineLan-XEPSS 0.3%CVE-2025-36754CRITICALAuthentication bypass on web interfaceEPSS 0.2%CVE-2025-36748HIGHStored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-XEPSS 0.2%CVE-2025-36751CRITICALMissing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-XEPSS 0.1%
Referências
https://csirt.divd.nl/CVE-2025-36750/