Vulnerability-Lookup

CNVD-2026-03176

Vulnerability from cnvd - Published: 2026-01-09

Title

Growatt ShineLan-X身份验证绕过漏洞（CNVD-2026-0317664）

Description

Growatt ShineLan-X是古瑞瓦特公司（Growatt）推出的一款太阳能逆变器数据采集器，主要用于将太阳能逆变器连接到网络，实现数据的远程监控和管理。 Growatt ShineLan-X存在身份验证绕过漏洞，该漏洞源于Web界面认证机制实现不当，攻击者可利用该漏洞导致绕过认证检查并执行中间人攻击。

Severity

中

Formal description

目前厂商尚未发布升级程序修复该安全问题，详情见厂商官网： https://www.growatt.com/

Reference

https://csirt.divd.nl/CVE-2025-36754/

Impacted products

Name
Growatt ShineLan-X >=3.6.0.0，<=3.6.0.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-36754",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-36754"
    }
  },
  "description": "Growatt ShineLan-X\u662f\u53e4\u745e\u74e6\u7279\u516c\u53f8\uff08Growatt\uff09\u63a8\u51fa\u7684\u4e00\u6b3e\u592a\u9633\u80fd\u9006\u53d8\u5668\u6570\u636e\u91c7\u96c6\u5668\uff0c\u4e3b\u8981\u7528\u4e8e\u5c06\u592a\u9633\u80fd\u9006\u53d8\u5668\u8fde\u63a5\u5230\u7f51\u7edc\uff0c\u5b9e\u73b0\u6570\u636e\u7684\u8fdc\u7a0b\u76d1\u63a7\u548c\u7ba1\u7406\u3002\n\nGrowatt ShineLan-X\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eWeb\u754c\u9762\u8ba4\u8bc1\u673a\u5236\u5b9e\u73b0\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7ed5\u8fc7\u8ba4\u8bc1\u68c0\u67e5\u5e76\u6267\u884c\u4e2d\u95f4\u4eba\u653b\u51fb\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://www.growatt.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-03176",
  "openTime": "2026-01-09",
  "products": {
    "product": "Growatt ShineLan-X \u003e=3.6.0.0\uff0c\u003c=3.6.0.2"
  },
  "referenceLink": "https://csirt.divd.nl/CVE-2025-36754/",
  "serverity": "\u4e2d",
  "submitTime": "2025-12-25",
  "title": "Growatt ShineLan-X\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2026-0317664\uff09"
}

CVE-2025-36754 (GCVE-0-2025-36754)

Vulnerability from cvelistv5 – Published: 2025-12-13 08:16 – Updated: 2025-12-16 11:02

Title

Authentication bypass on web interface

Summary

The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-15 20:27 UTC

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

DIVD ENISA root

References

1 reference

URL	Tags
https://csirt.divd.nl/CVE-2025-36754/	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Growatt	ShineLan-X	Affected: 3.6.0.0 , ≤ 3.6.0.2 (semver)

Credits

Hamid Rahmouni Victor Pasman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-15T20:27:48.035651Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-15T20:33:19.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ShineLan-X",
          "vendor": "Growatt",
          "versions": [
            {
              "lessThanOrEqual": "3.6.0.2",
              "status": "affected",
              "version": "3.6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hamid Rahmouni"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Pasman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The authentication mechanism on web interface is not properly implemented. It is\u00a0possible to bypass authentication checks by crafting a post request with new settings\u00a0since there is no session token or authentication in place. This would allow an\u00a0attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack."
            }
          ],
          "value": "The authentication mechanism on web interface is not properly implemented. It is\u00a0possible to bypass authentication checks by crafting a post request with new settings\u00a0since there is no session token or authentication in place. This would allow an\u00a0attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T11:02:11.379Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2025-36754/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Authentication bypass on web interface",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2025-36754",
    "datePublished": "2025-12-13T08:16:24.266Z",
    "dateReserved": "2025-04-15T21:54:36.815Z",
    "dateUpdated": "2025-12-16T11:02:11.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.