CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-21881: Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
8.6
CVSS
Description
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x
Classification
CVE ID: CVE-2024-21881
CVSS Base Severity: HIGH
CVSS Base Score: 8.6
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:I/V:C/RE:H
Problem Types
CWE-326 Inadequate Encryption StrengthAffected Products
Vendor: Enphase
Product: Envoy
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 7.28% (scored less or equal to compared to others)
EPSS Date: 2025-04-09 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: total
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-21881https://csirt.divd.nl/CVE-2024-21881
https://csirt.divd.nl/DIVD-2024-00011
https://enphase.com/cybersecurity/advisories/ensa-2024-6