Alexandros Tokatlis

A lack of encryption on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X allows an attacker with network access to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.

The Growatt ShineLan-X communication dongle contains an undocumented backup account with undocumented credentials. This allows significant access to the device, including access to the Setting Center, effectively creating a backdoor for devices utilizing the dongle.

The SolarEdge SE3680H device exhibits an unauthenticated disclosure of sensitive information during the bootloader loop. During device initialization and while awaiting boot instructions, the bootloader emits diagnostic output, potentially revealing operating system information.

The SolarEdge SE3680H ships with an outdated Linux kernel that has unpatched flaws in core subsystems. An attacker with network or local access could potentially achieve remote code execution, escalate privileges, or disclose sensitive information by exploiting these flaws.