CVE-2025-36754 Authentication bypass on web interface
Attackers can bypass authentication on the web interface to modify DNS settings, facilitating man-in-the-middle attacks on Growatt ShineLan-X devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-36754?
CVE-2025-36754 is a critical authentication bypass vulnerability in Growatt ShineLan-X, published on 13 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack.
Weakness: CWE-290
Which versions are affected by CVE-2025-36754?
How do I fix CVE-2025-36754?
No fix has been published for CVE-2025-36754 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-36754 being exploited?
There is no known exploitation of CVE-2025-36754 in the wild and no public exploit code.
Sources
Also known as GHSA-227r-vmhh-jq3x.