Enphase vulnerabilities
We track 6 vulnerabilities in Enphase products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on August 12, 2024.
Latest Enphase vulnerabilities
- 8.6 High severity
Envoy: Inadequate Encryption Strength
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x
- 7.2 High severity
Envoy: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7
- 8.8 High severity
Envoy: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.
- 9.8 Critical severity
Envoy: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.
- 9.1 Critical severity
IQ Gateway: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: fr
- 7.5 High severity
Enphase Installer Toolkit: Use of Hard-coded Credentials
Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.