CVE-2024-21880 — URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v…

CVE-2024-21880

URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x PUBLISHED

Description (CNA)

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x

Affected (CNA)

Vendor / product	Versions
Enphase / Envoy	affected 7.x; affected 6.x; affected 5.x; affected 4.x

CWE

CWE-77

References

https://csirt.divd.nl/CVE-2024-21880
https://csirt.divd.nl/DIVD-2024-00011
https://enphase.com/cybersecurity/advisories/ensa-2024-5

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.