CVE-2024-21880 Command injection in Envoy
An authenticated attacker can execute arbitrary OS commands via URL parameter manipulation in Enphase IQ Gateway devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21880?
CVE-2024-21880 is a high-severity command injection vulnerability in Enphase Envoy, published on 10 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x
Which versions are affected by CVE-2024-21880?
It affects 1 product.
Products include Enphase Iq Gateway Firmware.
How do I fix CVE-2024-21880?
No fix has been published for CVE-2024-21880 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-21880 being exploited?
There is no known exploitation of CVE-2024-21880 in the wild and no public exploit code.
Other vulnerabilities in Enphase Envoy
- CVE-2024-21876 Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225
- CVE-2024-21879 Command injection in Envoy
- CVE-2024-21877 Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225
- CVE-2024-21878 Command injection in Envoy
Sources
Also known as GHSA-f56c-x89x-xgxh.