What’s Vulnerable › Vulnerabilities

CVE-2023-32274: Enphase Installer Toolkit Android App Use of Hard-coded Credentials

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-20 · updated 2026-06-17
• Weakness: CWE-798

Description

Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.

Affected products

• Enphase Installer Toolkit: 3.27.0

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02

Get alerted when CVE-2023-32274 or the next vulnerability affects your stack