Shinelan X
Approved changes feed: RSS · Atom
cpe:2.3:a:growatt:shinelan-x:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Growatt (65d682fa-8d7c-51ff-b291-4e71ea076feb) |
|---|---|
| Product | Shinelan X (2ad22503-f787-54a2-b600-c03dbadc81d9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-36754 |
vulnerable | 2026-06-08 07:21:02.149741 |
Authentication bypass on web interface
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack.
Published: 2025-12-13T08:16:24.266Z
Updated: 2025-12-16T11:02:11.379Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36753 |
vulnerable | 2026-06-08 07:21:02.149181 |
SWD Interface Open on Growatt ShineLan-X
The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device
Published: 2025-12-13T08:16:22.056Z
Updated: 2025-12-16T11:02:10.315Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36752 |
vulnerable | 2026-06-08 07:21:02.148725 |
Undocumented backup Account and No Password Configuration Capability
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.
Published: 2025-12-13T08:16:25.088Z
Updated: 2026-01-07T14:43:33.184Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36751 |
vulnerable | 2026-06-08 07:21:02.148296 |
Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
Published: 2025-12-13T08:16:21.309Z
Updated: 2025-12-16T11:02:09.858Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36750 |
vulnerable | 2026-06-08 07:21:02.147939 |
Stored cross site scripting (XSS) vulnerability in Growatt ShineLan-X
ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via a direct post. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.
Published: 2025-12-13T08:16:22.832Z
Updated: 2025-12-16T11:02:10.775Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36748 |
vulnerable | 2026-06-08 07:21:02.147440 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36747 |
vulnerable | 2026-06-08 07:21:02.145257 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.