CVE-2024-21876

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

Affected Software

VendorProductVersion RangeStatus
EnphaseIQ Gateway8.0 < 8.2.4225affected
EnphaseIQ Gateway7.xaffected
EnphaseIQ Gateway6.xaffected
EnphaseIQ Gateway5.xaffected
EnphaseIQ Gateway4.xaffected

Weaknesses

  • CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

It is adviced to not expose this device to untrusted network acces. In other words, make sure this decvice is not reachable from the internet, a guest network or a public network.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References