Lucene search

DIVDCVE-2024-21880

HistoryAug 12, 2024 - 1:38 p.m.

CVE-2024-21880

2024-08-1213:38:15

CWE-77

CWE-78

DIVD

web.nvd.nist.gov

cve-2024-21880

command injection

enphase iq gateway

os commands

url parameter manipulations

envoy

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:L/VI:H/SI:L/VA:H/SA:L/S:P/AU:Y/R:I/V:C/RE:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

28.7%

JSON

Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x

Affected configurations

Nvd

Node

enphaseiq_gateway_firmwareRange4.0–7.3.120

AND

enphaseiq_gatewayMatch-

VendorProductVersionCPE
enphaseiq_gateway_firmwarecpe:/o:enphase:iq_gateway_firmware::::

Vendor	Product	Version	CPE
enphase	iq_gateway_firmware		cpe:/o:enphase:iq_gateway_firmware::::

CNA Affected

[
  {
    "vendor": "Enphase",
    "product": "Envoy",
    "versions": [
      {
        "status": "affected",
        "version": "7.x",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.x",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "5.x",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.x",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

csirt.divd.nl/CVE-2024-21880

csirt.divd.nl/DIVD-2024-00011

enphase.com/cybersecurity/advisories/ensa-2024-5

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:L/VI:H/SI:L/VA:H/SA:L/S:P/AU:Y/R:I/V:C/RE:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

28.7%

JSON

Related for CVE-2024-21880