CVE-2020-25752
First published: Wed Jun 16 2021(Updated: )
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Enphase Envoy | =d4.0 | |
| Enphase Envoy | =r3.0 | |
| Enphase Envoy Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-25752?
CVE-2020-25752 has a medium severity rating due to the presence of hardcoded passwords for critical accounts.
How do I fix CVE-2020-25752?
To mitigate CVE-2020-25752, change default passwords and enhance the security of the device by applying updates from the vendor.
What devices are affected by CVE-2020-25752?
CVE-2020-25752 affects Enphase Envoy devices running firmware versions R3.x and D4.x.
What is the nature of the vulnerability in CVE-2020-25752?
CVE-2020-25752 is caused by hardcoded passwords that can be exploited to gain unauthorized access to installer and Enphase accounts.
Is there a public disclosure for CVE-2020-25752?
Yes, CVE-2020-25752 has been publicly disclosed, highlighting the security vulnerability in Enphase Envoy devices.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/enphase
- canonical/enphase envoy
- version/enphase envoy/d4.0
- version/enphase envoy/r3.0
- canonical/enphase envoy firmware