CVE-2023-33869: Enphase Envoy OS Command Injection

Published Jun 20, 2023

Updated

Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.

Affected Software

5 affected components

Enphase Envoy: D7.0.88

Enphase Envoy Firmware=d7.0.88

Enphase Envoy

All of the following

Enphase Envoy Firmware=d7.0.88

Enphase Envoy

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Enphase Envoy OS to a version that resolves this vulnerability.
Fixed in D7.0.88

Event History

Jun 20, 2023

CVE Published

via MITRE·07:43 PM

Data Sourced

via MITRE·07:43 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-171-01

Frequently Asked Questions

What is CVE-2023-33869?

CVE-2023-33869 is a vulnerability in Enphase Envoy versions D7.0.88 that allows for command injection, potentially enabling an attacker to execute root commands.

How severe is CVE-2023-33869?

CVE-2023-33869 has a severity rating of 9.8, which is classified as critical.

Which Enphase Envoy versions are affected by CVE-2023-33869?

Enphase Envoy versions D7.0.88 are affected by CVE-2023-33869.

How can an attacker exploit CVE-2023-33869?

An attacker can exploit CVE-2023-33869 to execute unauthorized root commands through command injection.

Is there a fix available for CVE-2023-33869?

It is recommended to update to a patched version of Enphase Envoy firmware to mitigate CVE-2023-33869.