CVE-2024-21878
CRITICALEnphase IQ Gateway Firmware 4.0-8.2.4225 - OS Command Injection in Internal Script
Title source: llmDescription
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched.
References (3)
Core 3
Core References
Third Party Advisory third-party-advisory
https://csirt.divd.nl/CVE-2024-21878
Third Party Advisory related
https://csirt.divd.nl/DIVD-2024-00011
Vendor Advisory vendor-advisory
https://enphase.com/cybersecurity/advisories/ensa-2024-3
Scores
CVSS v3
9.8
EPSS
0.0143
EPSS Percentile
69.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-77
CWE-78
Status
published
Products (1)
enphase/iq_gateway_firmware
4.0 - 8.2.4225
Published
Aug 12, 2024
Tracked Since
Feb 18, 2026