CVE-2024-21881 — Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x

CVE-2024-21881

Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x PUBLISHED

Description (CNA)

Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

Affected (CNA)

Vendor / product	Versions
Enphase / Envoy	affected 5.x; affected 4.x

CWE

CWE-326

References

https://csirt.divd.nl/CVE-2024-21881
https://csirt.divd.nl/DIVD-2024-00011
https://enphase.com/cybersecurity/advisories/ensa-2024-6

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.