Vulnerabilities

TI-2024-14544 CVE-2024-21879 · GHSA-j7f9-7qqh-2rxf

Command injection in Enphase Envoy

MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Inj…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02496 Published 2024-08-10 Fixed in 8.2.4225 CWE-77

TI-2024-14542 CVE-2024-21877 · GHSA-w96m-rw5m-pf44

Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

MEDIUM 49

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00786 Published 2024-08-10 Fixed in 8.2.4225 CWE-22

TI-2024-14543 CVE-2024-21878 · GHSA-hch6-3cq4-hjhm

Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x

MEDIUM 51

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01445 Published 2024-08-10 Fixed in 8.2.4225 CWE-77

Vulnerabilities

Filters

Command injection in Enphase Envoy

Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x