Code injection

An issue was discovered on Enphase Envoy R3.x and D4.x and other current devices. The upgradestart function in /installer/upgradestart allows remote authenticated users to execute arbitrary commands via the force parameter...

CVE-2020-25755

CVE-2020-25755 affects Enphase Envoy R3.x, D4.x (and other current devices). The issue is in the upgrade_start function (in /installer/upgrade_start), which allows remote authenticated users to execute arbitrary commands via the force parameter. Impact is described as remote command execution wit...