CVE-2020-25755: OS Command Injection
Published Jun 16, 2021
·Updated
An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgradestart function in /installer/upgradestart allows remote authenticated users to execute arbitrary commands via the force parameter.
Affected Software
3 affected components
Enphase Envoy Firmware=d4.0
Enphase Envoy Firmware=r3.0
Enphase Envoy
Event History
Jun 16, 2021
CVE Published
via MITRE·06:27 PM
Data Sourced
via MITRE·06:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-25755?
CVE-2020-25755 is categorized with a high severity due to its potential for remote command execution.
2
How do I fix CVE-2020-25755?
To fix CVE-2020-25755, ensure that you update the Enphase Envoy firmware to the latest version provided by the vendor.
3
Which devices are affected by CVE-2020-25755?
CVE-2020-25755 affects Enphase Envoy R3.x and D4.x firmware versions.
4
What kind of attack does CVE-2020-25755 enable?
CVE-2020-25755 enables remote authenticated users to execute arbitrary commands on vulnerable devices.
5
Is CVE-2020-25755 specific to certain firmware versions?
Yes, CVE-2020-25755 specifically affects Enphase Envoy firmware versions R3.0 and D4.0.