CVE-2020-25755

Опубликовано: 16 июн. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.

Ссылки

https://enphase.com/en-us/products-and-services/envoy-and-combiner
Product
Vendor Advisory
https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
Exploit
Third Party Advisory
https://stage2sec.com
Third Party Advisory
https://enphase.com/en-us/products-and-services/envoy-and-combiner
Product
Vendor Advisory
https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
Exploit
Third Party Advisory
https://stage2sec.com
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:enphase:envoy_firmware:d4.0:*:*:*:*:*:*:*

cpe:2.3:o:enphase:envoy_firmware:r3.0:*:*:*:*:*:*:*

cpe:2.3:h:enphase:envoy:-:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.03118

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-4255-c99r-j52r