CVE-2025-36744
📋 TL;DR
SolarEdge SE3680H inverters leak sensitive diagnostic information during bootloader initialization cycles. This allows unauthenticated attackers to gather system information that could aid further attacks. Only SolarEdge SE3680H inverters are affected.
💻 Affected Systems
- SolarEdge SE3680H
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure could reveal system details that facilitate more serious attacks like firmware manipulation or authentication bypass.
Likely Case
Attackers gather system information to fingerprint devices and plan targeted attacks.
If Mitigated
Limited to information gathering with no direct system compromise.
🎯 Exploit Status
Exploitation requires monitoring bootloader diagnostic output during device initialization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check SolarEdge firmware updates
Vendor Advisory: https://csirt.divd.nl/CVE-2025-36744
Restart Required: Yes
Instructions:
1. Contact SolarEdge support for firmware updates. 2. Apply latest firmware to affected SE3680H inverters. 3. Reboot devices after firmware update.
🔧 Temporary Workarounds
Physical Access Restriction
allRestrict physical and network access to inverter serial/console ports during boot cycles.
Network Segmentation
allIsolate inverters on separate network segments with strict access controls.
🧯 If You Can't Patch
- Implement strict physical security controls around inverter installations
- Monitor network traffic to inverter management interfaces for unusual access patterns
🔍 How to Verify
Check if Vulnerable:
Monitor bootloader diagnostic output during SE3680H initialization for information leakage.Check Version:
Check inverter display or SolarEdge monitoring portal for firmware versionVerify Fix Applied:
Check firmware version against SolarEdge security advisory and verify no sensitive information appears in bootloader output.📡 Detection & Monitoring
Log Indicators:
- Repeated boot cycles
- Unauthenticated access to diagnostic interfaces
Network Indicators:
- Unexpected connections to inverter management ports during boot
SIEM Query:
Search for repeated connection attempts to inverter IPs on management ports