CVE-2025-36752 Undocumented backup Account and No Password Configuration Capability

Critical 9.4 Published 13 Dec 2025 Updated 7 Jan 2026

An undocumented backup account with hardcoded credentials allows attackers to gain significant access to Growatt ShineLan-X communication dongles.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-36752?

CVE-2025-36752 is a critical vulnerability in Growatt ShineLan-X, published on 13 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.

Weakness: CWE-798

Which versions are affected by CVE-2025-36752?

It affects 1 product.

Products include Growatt Shine Lan-X Firmware.

How do I fix CVE-2025-36752?

No fix has been published for CVE-2025-36752 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-36752 being exploited?

There is no known exploitation of CVE-2025-36752 in the wild and no public exploit code.

Sources

Also known as GHSA-pfgg-8369-6x8v.