High · 8.6 CVE-2024-21881 EUVD-2024-19492GHSA-7q95-85ph-5grx

Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x

Published Aug 10, 2024 · Updated Mar 11, 2025 · Assigned by DIVD

Description

Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

Affected products

Vendor	Product	Affected	Fixed
Enphase	Envoy	5.x, 4.x	—

References

https://csirt.divd.nl/CVE-2024-21881 third-party-advisory
https://csirt.divd.nl/DIVD-2024-00011 related
https://enphase.com/cybersecurity/advisories/ensa-2024-6 vendor-advisory