CVE-2025-36754 - CVE House
Back to Database
Status published Critical CVE-2025-36754

Authentication bypass on web interface

Vulnerability Description

The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-36754

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Hamid Rahmouni
  • Victor Pasman

References

More from Growatt

View All →
CVE-2025-36753
SWD Interface Open on Growatt ShineLan-X
High 8.6
CVE-2025-36752
Undocumented backup Account and No Password Configuration Capability
Critical 9.4
CVE-2025-36751
Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X
Critical 9.4
CVE-2025-36750
Stored cross site scripting (XSS) vulnerability in Growatt ShineLan-X
High 8.5
CVE-2025-36748
Stored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-X
High 8.4

Affected Vendor

Affected Software

ShineLan-X
Vulnerable Versions:
3.6.0.0

Timeline

Official Publish: December 13th, 2025
Last Modified: December 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-290

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Collection
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access