Skip to content
OpenAdvisories

Vendor

Enphase

8 known vulnerabilities.

Products

Envoy 6 Enphase Installer Toolkit 1 IQ Gateway 1 Installer Toolkit 0
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2024-21879

    URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4…

    Enphase Envoy
  • High 8.6
    CVE-2024-21880

    URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= …

    Enphase Envoy
  • High 8.6
    CVE-2024-21881

    Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x

    Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

    Enphase Envoy
  • High 8.6
    CVE-2023-32274

    Enphase Installer Toolkit Android App Use of Hard-coded Credentials

    Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.

    Enphase Enphase Installer Toolkit