PatchTheCVECVE-2025-36747: ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to
CVE-2025-36747 is a critical-severity flaw (CVSS 9.8) affecting shine lan-x firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 75%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2025-12-13 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-36747?
shine lan-x firmware: upgrade to 3.6.0.2. Exact commands for each OS are on this page.
Is CVE-2025-36747 being exploited?
CVE-2025-36747 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-36747 affect?
CVE-2025-36747 affects shine lan-x firmware. Severity is critical (CVSS 9.8). ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to dev
How urgent is CVE-2025-36747?
Priority 45/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-36752 CRITICAL 9.8 UPGRADE Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which
- CVE-2025-36753 CRITICAL 9.8 UPGRADE The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an at
- CVE-2025-36748 MEDIUM 5.4 UPGRADE ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server
- CVE-2025-36750 MEDIUM 5.4 UPGRADE ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field