High · 8.7 CVE-2024-21879 EUVD-2024-19490GHSA-j7f9-7qqh-2rxf

URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225

Published Aug 10, 2024 · Updated Mar 11, 2025 · Assigned by DIVD

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

Affected products

Vendor	Product	Affected	Fixed
Enphase	Envoy	8.x – < 8.2.4225, 7.x, 6.x, 5.x, 4.x	8.2.4225

References

https://csirt.divd.nl/CVE-2024-21879 third-party-advisory
https://csirt.divd.nl/DIVD-2024-00011 related
https://enphase.com/cybersecurity/advisories/ensa-2024-4 vendor-advisory