CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21876 – Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225
https://notcve.org/view.php?id=CVE-2024-21876
10 Aug 2024 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225. • https://csirt.divd.nl/CVE-2024-21876 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 0CVE-2024-21879 – URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225
https://notcve.org/view.php?id=CVE-2024-21879
10 Aug 2024 — Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225. • https://csirt.divd.nl/CVE-2024-21879 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21877 – Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225
https://notcve.org/view.php?id=CVE-2024-21877
10 Aug 2024 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authenticatio... • https://csirt.divd.nl/CVE-2024-21877 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21878 – Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x
https://notcve.org/view.php?id=CVE-2024-21878
10 Aug 2024 — Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched. • https://csirt.divd.nl/CVE-2024-21878 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.6EPSS: 1%CPEs: 2EXPL: 0CVE-2024-21880 – URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x
https://notcve.org/view.php?id=CVE-2024-21880
10 Aug 2024 — Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x • https://csirt.divd.nl/CVE-2024-21880 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21881 – Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
https://notcve.org/view.php?id=CVE-2024-21881
10 Aug 2024 — Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x • https://csirt.divd.nl/CVE-2024-21881 • CWE-326: Inadequate Encryption Strength •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2023-33869 – Enphase Envoy OS Command Injection
https://notcve.org/view.php?id=CVE-2023-33869
20 Jun 2023 — Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-01 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32274 – Enphase Installer Toolkit Android App Use of Hard-coded Credentials
https://notcve.org/view.php?id=CVE-2023-32274
20 Jun 2023 — Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02 • CWE-798: Use of Hard-coded Credentials •
CVSS: 8.8EPSS: 4%CPEs: 3EXPL: 1CVE-2020-25755
https://notcve.org/view.php?id=CVE-2020-25755
16 Jun 2021 — An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter. Se detectó un problema en los dispositivos Enphase Envoy versiones R3.x y D4.x (y otros actuales). La función upgrade_start en la ruta /installer/upgrade_start permite a usuarios autenticados remotos ejecutar comandos arbitrarios por medio del parámetro force • https://enphase.com/en-us/products-and-services/envoy-and-combiner • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-25754
https://notcve.org/view.php?id=CVE-2020-25754
16 Jun 2021 — An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Attempts to change the user password via passwd or other tools have no effect. • https://enphase.com/en-us/products-and-services/envoy-and-combiner • CWE-916: Use of Password Hash With Insufficient Computational Effort •