Enphase Envoy vulnerabilities

CVE-2023-33869 [CRITICAL] CWE-78 CVE-2023-33869: Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attac Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.

CVE-2024-21878 [CRITICAL] CWE-77 CVE-2024-21878: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched.

CVE-2024-21879 [HIGH] CWE-77 CVE-2024-21879: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability th Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

CVE-2024-21881 [HIGH] CWE-326 CVE-2024-21881: Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

CVE-2024-21880 [HIGH] CWE-77 CVE-2024-21880: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability vi Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x

CVE-2019-7678 [CRITICAL] CWE-22 CVE-2019-7678: A directory traversal vulnerability was discovered in Enphase Envoy R3.*.* via images/, include/, in A directory traversal vulnerability was discovered in Enphase Envoy R3.*.* via images/, include/, include/js, or include/css on TCP port 8888.

CVE-2019-7676 [HIGH] CWE-521 CVE-2019-7676: A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 888 A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account.

CVE-2024-21877 [MEDIUM] CWE-22 CVE-2024-21877: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225.

CVE-2019-7677 [MEDIUM] CWE-79 CVE-2019-7677: XSS exists in Enphase Envoy R3.*.* via the profileName parameter to the /home URI on TCP port 8888. XSS exists in Enphase Envoy R3.*.* via the profileName parameter to the /home URI on TCP port 8888.