CVE-2025-36753
📋 TL;DR
The SWD debug interface on Growatt ShineLan-X communication dongles is enabled by default, allowing attackers to gain debug access to extract secrets or domains from the device. This affects all users of vulnerable Growatt ShineLan-X dongles in their default configuration.
💻 Affected Systems
- Growatt ShineLan-X communication dongle
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the dongle allowing extraction of all stored secrets, firmware modification, and potential lateral movement to connected systems.
Likely Case
Extraction of sensitive configuration data, credentials, or domain information from the dongle.
If Mitigated
Limited impact if debug interface is disabled or physical access is restricted.
🎯 Exploit Status
Exploitation requires physical access to debug pins or network access to debug interface. Standard SWD debugging tools can be used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://csirt.divd.nl/CVE-2025-36753/
Restart Required: No
Instructions:
No official patch available. Follow workarounds to disable SWD debug interface in firmware or physically disable access.
🔧 Temporary Workarounds
Disable SWD debug interface
allModify firmware configuration to disable SWD debug interface functionality
Requires firmware modification - consult manufacturer for specific instructions
Physical access restriction
allPhysically secure devices to prevent unauthorized access to debug pins
Implement physical security controls around device installation
🧯 If You Can't Patch
- Isolate vulnerable devices on separate network segments with strict access controls
- Implement physical security measures to prevent unauthorized physical access to devices
🔍 How to Verify
Check if Vulnerable:
Check if SWD debug interface is accessible via debug pins or network interface using standard SWD debugging toolsCheck Version:
No standard version check command - check device labeling or manufacturer documentationVerify Fix Applied:
Attempt to connect to SWD debug interface - successful connection indicates vulnerability still present📡 Detection & Monitoring
Log Indicators:
- Unusual debug access attempts
- Firmware modification logs
Network Indicators:
- Unexpected SWD protocol traffic on network
- Debug interface connection attempts
SIEM Query:
Search for SWD protocol traffic or debug interface access patterns