Critical · published December 13, 2025
⚡ The SWD debug interface on the Growatt ShineLan-X is wide open by default — a backdoor just waiting for the wrong hands! 🔓 Think of it like a hotel room left unlocked; anyone passing by can just waltz in and peek at your belongings, no one even checking for a guest pass! With this vulnerability, an attacker could gain full debug access to the device, potentially extracting sensitive secrets and internal domains. This could lead to further exploitation or unauthorized control over your system — absolutely devastating!
Think of it like a hotel room left unlocked; anyone passing by can just waltz in and peek at your belongings, no one even checking for a guest pass! CVE-2025-36753 allows unauthorized users to access the SWD debug interface of the Growatt ShineLan-X, which can be exploited without any authentication, enabling attackers to extract sensitive information.
With this vulnerability, an attacker could gain full debug access to the device, potentially extracting sensitive secrets and internal domains. This could lead to further exploitation or unauthorized control over your system — absolutely devastating! Patch the Growatt ShineLan-X firmware immediately to disable the debug interface by default. Additionally, restrict access to the device and ensure proper authentication mechanisms are in place to prevent unauthorized access. 💪 You've got this! Take action now, and you'll secure your devices in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| growatt/shine_lan-x_firmware | ≥ 3.6.0.0, < 3.6.0.2 | 3.6.0.2 |