CVE-2020-25752: Medium severity enphase envoy vulnerability
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25752?
CVE-2020-25752 has a medium severity rating due to the presence of hardcoded passwords for critical accounts.
How do I fix CVE-2020-25752?
To mitigate CVE-2020-25752, change default passwords and enhance the security of the device by applying updates from the vendor.
What devices are affected by CVE-2020-25752?
CVE-2020-25752 affects Enphase Envoy devices running firmware versions R3.x and D4.x.
What is the nature of the vulnerability in CVE-2020-25752?
CVE-2020-25752 is caused by hardcoded passwords that can be exploited to gain unauthorized access to installer and Enphase accounts.
Is there a public disclosure for CVE-2020-25752?
Yes, CVE-2020-25752 has been publicly disclosed, highlighting the security vulnerability in Enphase Envoy devices.