Read the docs

Enphase

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Enphase records in CISA KEV

No Enphase vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Envoy Firmware 5 records MEDIUM Iq Gateway Firmware 5 records MEDIUM Envoy 3 records MEDIUM Installer Toolkit 1 record MEDIUM

Records

5 records in Iq Gateway Firmware · all components

TI-2024-14545 CVE-2024-21880 · GHSA-f56c-x89x-xgxh

Command injection in Enphase Envoy

Priority MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Inje…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02353 Published 2024-08-10 No fix listed CWE-77
TI-2024-14544 CVE-2024-21879 · GHSA-j7f9-7qqh-2rxf

Command injection in Enphase Envoy

Priority MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Inj…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02496 Published 2024-08-10 Fixed in 8.2.4225 CWE-77
TI-2024-14541 CVE-2024-21876 · GHSA-wwmm-864r-f54x

Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225

Priority MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbit…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00803 Published 2024-08-10 Fixed in 8.2.4225 CWE-22
Open these records in search →