Critical · published December 13, 2025
🚨 A hidden backup account in the Growatt ShineLan-X dongle is a serious security hole! 🔥 Imagine a hotel that has a secret room with a master key nobody knows about — anyone with that key can access all the rooms without check-in. This undocumented backdoor lets attackers stroll right into the Setting Center, bypassing all regular security checks! If exploited, an attacker could gain full control over the device, tweaking settings and potentially compromising the entire system. This could lead to unauthorized access to sensitive data or disruptions in device operation, putting systems and users at serious risk.
Imagine a hotel that has a secret room with a master key nobody knows about — anyone with that key can access all the rooms without check-in. This undocumented backdoor lets attackers stroll right into the Setting Center, bypassing all regular security checks! The CVE-2025-36752 vulnerability allows unauthorized access via an undocumented backup account with unknown credentials, enabling attackers to manipulate device settings without proper authorization.
If exploited, an attacker could gain full control over the device, tweaking settings and potentially compromising the entire system. This could lead to unauthorized access to sensitive data or disruptions in device operation, putting systems and users at serious risk. Update the firmware of the Growatt ShineLan-X communication dongle as soon as an official patch is released. Additionally, review your network for unauthorized access and ensure all other security measures are up to date to minimize exposure. Stay vigilant! You've got this! By following the steps to secure your device, you can keep your system safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| growatt/shine_lan-x_firmware | ≥ 3.6.0.0, < 3.6.0.2 | 3.6.0.2 |