PatchTheCVECVE-2025-36748: ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server
CVE-2025-36748 is a medium-severity flaw (CVSS 5.4) affecting shine lan-x firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 95%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2025-12-13 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-36748?
shine lan-x firmware: upgrade to 3.6.0.2. Exact commands for each OS are on this page.
Is CVE-2025-36748 being exploited?
CVE-2025-36748 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-36748 affect?
CVE-2025-36748 affects shine lan-x firmware. Severity is medium (CVSS 5.4). ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legi
How urgent is CVE-2025-36748?
Priority 20/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-36752 CRITICAL 9.8 UPGRADE Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which
- CVE-2025-36747 CRITICAL 9.8 UPGRADE ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to
- CVE-2025-36753 CRITICAL 9.8 UPGRADE The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an at
- CVE-2025-36750 MEDIUM 5.4 UPGRADE ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field