Vulnerability in Enphase Envoy
CVE-2024-21881
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x
Published · last modified .
EPSS exploit prediction
EPSS: 0.003 (19.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Enphase Envoy — versions 5.x, 4.x
Weakness classification (CWE)
References
- csirt.divd.nl/CVE-2024-21881 (third-party-advisory)
- csirt.divd.nl/DIVD-2024-00011 (related)
- enphase.com/cybersecurity/advisories/ensa-2024-6 (vendor-advisory)