CVE-2024-21879 — URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v…

CVE-2024-21879

URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225 PUBLISHED

Description (CNA)

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

Affected (CNA)

Vendor / product	Versions
Enphase / Envoy	affected 8.x before 8.2.4225; affected 7.x; affected 6.x; affected 5.x; affected 4.x

CWE

CWE-77

References

https://csirt.divd.nl/CVE-2024-21879
https://csirt.divd.nl/DIVD-2024-00011
https://enphase.com/cybersecurity/advisories/ensa-2024-4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.