Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2024-21878

Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DIVD

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Enphase Envoy

Default version status: affected

  • 8.x to < 8.2.4225affected
  • 7.xaffected
  • 6.xaffected
  • 5.xaffected
  • 4.xaffected

References