CVE-2024-21877: Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

Q: What is the severity of CVE-2024-21877?

CVE-2024-21877 is considered a high-severity vulnerability due to its potential for file manipulation.

Q: How do I fix CVE-2024-21877?

To mitigate CVE-2024-21877, ensure your Enphase IQ Gateway firmware is updated to version 8.2.4225 or later.

Q: Which versions of Enphase IQ Gateway are affected by CVE-2024-21877?

CVE-2024-21877 affects Enphase IQ Gateway firmware versions from 4.x to below 8.2.4225.

Q: What type of vulnerability is CVE-2024-21877?

CVE-2024-21877 is a Path Traversal vulnerability that allows unauthorized file manipulation.

Q: Is authentication required to exploit CVE-2024-21877?

Yes, exploiting CVE-2024-21877 requires authentication to the Enphase IQ Gateway.

Published Aug 10, 2024

Updated

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225.

Affected Software

2 affected components

All of the following

Enphase Iq Gateway Firmware>=4.0<8.2.4225

Enphase IQ Gateway

Remediation

Information

Devices are remotely being updated by the vendor.

Event History

Aug 10, 2024

CVE Published

via MITRE·05:44 PM

Data Sourced

via MITRE·05:44 PM

RemedyDescriptionWeakness

Aug 12, 2024

Data Sourced

via NVD·01:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-21877?

CVE-2024-21877 is considered a high-severity vulnerability due to its potential for file manipulation.

How do I fix CVE-2024-21877?