| SolarEdge SE3680H (SE3680H)
|
|
Security Grade
Calculator v1
|
SolarEdge SE3680H (SE3680H)
Release Date: 2020-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
—
|
The inverter is typically wall-mounted inside a locked enclosure or a plant room with DC isolators; reaching its commissioning interface requires physical access and tooling. No published tampering research specific to this model was found. Provisional value.
|
| Known vulnerabilities
|
Rare
|
[https://nvd.nist.gov/vuln/detail/CVE-2025-36743
https://nvd.nist.gov/vuln/detail/CVE-2025-36745 🔗 Proof]
|
Three CVEs list se3680h directly in their CPE configurations. CVE-2025-36745 (CVSS 7.8) is the most serious: the unit ships with an outdated Linux kernel containing unpatched core subsystem flaws. CVE-2025-36743 (CVSS 6.8) exposes a debug/test interface to unauthenticated actors, and CVE-2025-36744 (CVSS 2.4) leaks sensitive information during the bootloader loop.
|
| Prior attacks
|
None
|
—
|
No recorded attack naming this model was found. Solar inverters are a recognised grid-security concern, but no campaign against SE3680H specifically is documented, so the value is the minimum. Provisional value.
|
| Updatability
|
Rare
|
🔗 Proof
|
SolarEdge pushes firmware to managed sites through its monitoring platform, which is better than purely manual updates, but units not enrolled to the platform or offline stay on old firmware, and the shipped kernel flaw in CVE-2025-36745 suggests long update cycles in practice.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
CVE-2025-36743 exposes a debug and test interface reachable without authentication, so a connecting party can reach system internals and potentially execute code without presenting credentials.
|
| Communications
|
Encrypted with up-to-date encryption
|
—
|
Communication between the inverter and the SolarEdge monitoring portal is TLS-protected, which is why the criteria score for encryption is the favourable one. Local commissioning interfaces over RS485 and the on-device web server are a different matter and are not covered by that encryption. Provisional on the local side.
|
| Storage
|
No encryption
|
—
|
Configuration and any locally stored credentials are held in inverter flash without documented at-rest encryption. Provisional value, not directly evidenced for this model.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
—
|
Account management is largely delegated to the SolarEdge monitoring platform, with a limited installer/user split on the device itself. Provisional value, not directly evidenced for this model.
|
| Authentication
|
Basic
|
🔗 Proof
|
Installer and user logins exist on the device, but the debug interface described in CVE-2025-36743 is reachable without authentication, so the login layer is only partially effective.
|
| Brute-force protection
|
Absent
|
—
|
No documented lockout or rate limiting on failed logins at the device level. Provisional value, not directly evidenced for this model.
|
| Event logging
|
Partial logging
|
—
|
The device keeps local event and fault records, and the monitoring portal keeps a separate history, but there is no tamper-evident local log. Provisional value, not directly evidenced for this model.
|
| Passwords
|
Require change after setup
|
—
|
Commissioning requires setting an installer password and SolarEdge does not ship a single fixed factory default, but no complexity rule is documented on the device itself. Provisional value.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded Linux (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Ethernet (RJ45), Wi-Fi, RS485, cellular (optional)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
The SolarEdge SE3680H is a single-phase HD-Wave residential PV inverter. Three CVEs list se3680h in their CPE configurations. CVE-2025-36745 (CVSS 7.8) is the most consequential: the unit ships an outdated Linux kernel with unpatched flaws in core subsystems, meaning the attack surface is the whole operating system rather than one web handler. CVE-2025-36743 (CVSS 6.8) exposes an unauthenticated debug and test interface, and CVE-2025-36744 (CVSS 2.4) leaks information during the bootloader loop. What separates this device from the cameras assessed here is blast radius rather than flaw count: an inverter sits on the DC side of a residential solar installation and manages grid synchronisation, so a compromise can affect power delivery and, in aggregate across many units, grid stability, which is why regulators have taken an interest in inverter security. Against that, SolarEdge does push firmware through its monitoring platform, which is a better update story than the manually-updated cameras. The device is rated D: unauthenticated access to a debug interface and a stale kernel are documented for this exact model, but no remote pre-auth full-compromise CVE and no recorded exploitation campaign exist, so the evidence does not reach the F band. Several values, notably communications and storage encryption on local interfaces, are provisional because no model-level SolarEdge documentation could be retrieved.
