Vulnerabilities

TI-2024-14541 CVE-2024-21876 · GHSA-wwmm-864r-f54x

Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225

MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbit…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00803 Published 2024-08-10 Fixed in 8.2.4225 CWE-22

TI-2024-14544 CVE-2024-21879 · GHSA-j7f9-7qqh-2rxf

Command injection in Enphase Envoy

MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Inj…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02496 Published 2024-08-10 Fixed in 8.2.4225 CWE-77

TI-2024-14542 CVE-2024-21877 · GHSA-w96m-rw5m-pf44

Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

MEDIUM 49

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00786 Published 2024-08-10 Fixed in 8.2.4225 CWE-22

TI-2024-14543 CVE-2024-21878 · GHSA-hch6-3cq4-hjhm

Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x

MEDIUM 51

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01445 Published 2024-08-10 Fixed in 8.2.4225 CWE-77

TI-2024-14545 CVE-2024-21880 · GHSA-f56c-x89x-xgxh

Command injection in Enphase Envoy

MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Inje…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02353 Published 2024-08-10 No fix listed CWE-77

TI-2024-14546 CVE-2024-21881 · GHSA-7q95-85ph-5grx

Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x

LOW 39

Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0029 Published 2024-08-10 No fix listed CWE-326

TI-2023-16741 CVE-2023-33869 · GHSA-wcfj-m59v-ggwc

Enphase Envoy OS Command Injection

MEDIUM 44

Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0107 Published 2023-06-20 No fix listed CWE-78

TI-2023-15572 CVE-2023-32274 · GHSA-j6vr-qgcv-8h6m

Enphase Installer Toolkit Android App Use of Hard-coded Credentials

MEDIUM 44

Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00571 Published 2023-06-20 No fix listed CWE-798

TI-2020-15764 CVE-2020-25755 · GHSA-4255-c99r-j52r

An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices.

MEDIUM 44

An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03076 Published 2021-06-16 No fix listed CWE-78

TI-2020-15763 CVE-2020-25754 · GHSA-cq4j-2685-h9rw

An issue was discovered on Enphase Envoy R3.x and D4.x devices.

LOW 36

An issue was discovered on Enphase Envoy R3.x and D4.x devices.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0135 Published 2021-06-16 No fix listed CWE-916

TI-2020-15762 CVE-2020-25753 · GHSA-qpjh-j88q-xpmv

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software.

MEDIUM 46

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02231 Published 2021-06-16 No fix listed

TI-2020-15761 CVE-2020-25752 · GHSA-84r8-qq95-wq5m

An issue was discovered on Enphase Envoy R3.x and D4.x devices.

LOW 27

An issue was discovered on Enphase Envoy R3.x and D4.x devices.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01603 Published 2021-06-16 No fix listed CWE-798

TI-2019-05416 CVE-2019-7678 · GHSA-g9qp-8pvh-p93g

A directory traversal vulnerability was discovered in Enphase Envoy R3.. via images/…

MEDIUM 47

A directory traversal vulnerability was discovered in Enphase Envoy R3.*.* via images/, include/, include/js, or include/css on TCP port 8888.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02486 Published 2019-02-09 No fix listed CWE-22

TI-2019-05415 CVE-2019-7677 · GHSA-f9ww-v5mx-p9gf

XSS exists in Enphase Envoy R3.. via the profileName parameter to the /home URI on TCP port 8888.

LOW 29

XSS exists in Enphase Envoy R3.*.* via the profileName parameter to the /home URI on TCP port 8888.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00902 Published 2019-02-09 No fix listed CWE-79

TI-2019-05414 CVE-2019-7676 · GHSA-mj45-vwww-g6pr

A weak password vulnerability was discovered in Enphase Envoy R3...

LOW 35

A weak password vulnerability was discovered in Enphase Envoy R3.*.*.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01686 Published 2019-02-09 No fix listed CWE-521

Vulnerabilities

Filters