CVE-2024-21881: Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
Published Aug 10, 2024
·Updated
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x
Affected Software
2 affected components
Envoy Envoy>=4.x<=5.x
Enphase IQ Gateway>=4.x<=5.x
Remediation
Information
Devices are remotely being updated by the vendor.
Event History
Aug 10, 2024
CVE Published
via MITRE·05:44 PM
Data Sourced
via MITRE·05:44 PM
RemedyDescriptionWeakness
Aug 12, 2024
Data Sourced
via NVD·01:38 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-21881?
CVE-2024-21881 is classified as a medium severity vulnerability.
2
How do I fix CVE-2024-21881?
To fix CVE-2024-21881, update Envoy and Enphase IQ Gateway to the latest version available.
3
Who can exploit CVE-2024-21881?
An authenticated attacker can exploit CVE-2024-21881 to execute arbitrary OS commands.
4
What versions are affected by CVE-2024-21881?
CVE-2024-21881 affects Envoy and Enphase IQ Gateway versions from 4.x to 5.x.
5
What type of vulnerability is CVE-2024-21881?
CVE-2024-21881 is an Inadequate Encryption Strength vulnerability.