CVE-2024-21880: URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21880?
CVE-2024-21880 has a high severity rating due to its potential for OS command injection.
How do I fix CVE-2024-21880?
To mitigate CVE-2024-21880, ensure that your Enphase IQ Gateway firmware is updated to a version that is above 7.3.120.
What systems are affected by CVE-2024-21880?
CVE-2024-21880 affects Enphase IQ Gateway devices running firmware versions from 4.0 to 7.3.120.
Is CVE-2024-21880 a remote exploit?
Yes, CVE-2024-21880 can be exploited remotely through the url parameter of an authenticated endpoint.
What type of vulnerability is CVE-2024-21880?
CVE-2024-21880 is classified as a command injection vulnerability, allowing attackers to execute arbitrary commands on the system.