Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:I/V:C/RE:H
Affected products
Enphase · Envoy