Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2024-21878

Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched.

CVSS 4.0 · 9.2 Critical EPSS 1.4% KEV · Not listed
Vendors
Enphase
Products
Envoy Iq Gateway Iq Gateway Firmware
CVE-2024-21876

Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Enphase
Products
Envoy Iq Gateway Iq Gateway Firmware
CVE-2024-21880

URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x

CVSS 4.0 · 8.6 High EPSS 2.4% KEV · Not listed
Vendors
Enphase
Products
Envoy Iq Gateway Iq Gateway Firmware
CVE-2024-21879

URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

CVSS 4.0 · 8.7 High EPSS 2.5% KEV · Not listed
Vendors
Enphase
Products
Envoy Iq Gateway Iq Gateway Firmware
CVE-2024-21877

Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Enphase
Products
Envoy Iq Gateway Iq Gateway Firmware