Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Enphase Component: Iq Gateway Firmware Clear all filters
TI-2024-14541 CVE-2024-21876 · GHSA-wwmm-864r-f54x

Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225

Priority MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbit…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00803 Published 2024-08-10 Fixed in 8.2.4225 CWE-22
TI-2024-14544 CVE-2024-21879 · GHSA-j7f9-7qqh-2rxf

Command injection in Enphase Envoy

Priority MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Inj…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02496 Published 2024-08-10 Fixed in 8.2.4225 CWE-77
TI-2024-14545 CVE-2024-21880 · GHSA-f56c-x89x-xgxh

Command injection in Enphase Envoy

Priority MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Inje…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02353 Published 2024-08-10 No fix listed CWE-77