CVE-2025-36751: Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36751?
CVE-2025-36751 is considered a high severity vulnerability due to the lack of encryption on the configuration interface.
How do I fix CVE-2025-36751?
To fix CVE-2025-36751, implement encryption for the configuration interface of the affected devices.
What are the affected devices for CVE-2025-36751?
The affected devices for CVE-2025-36751 are Growatt ShineLan-X and Growatt MIC 3300TL-X inverters.
What type of attack can occur due to CVE-2025-36751?
CVE-2025-36751 allows attackers on the same network to intercept and potentially manipulate communication between the inverter and its cloud endpoint.
Is network access required to exploit CVE-2025-36751?
Yes, an attacker must have network access to exploit CVE-2025-36751.