What’s Vulnerable › Vulnerabilities

CVE-2024-21878: Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-12 · updated 2026-06-17
• Weakness: CWE-77

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched.

Affected products

• Enphase IQ Gateway: from 4.0 before 8.2.4225 — fixed in 8.2.4225

How to fix

Upgrade to a fixed version: Enphase IQ Gateway 8.2.4225. Check the vendor advisory for mitigations.

References

• https://csirt.divd.nl/CVE-2024-21878
• https://csirt.divd.nl/DIVD-2024-00011
• https://enphase.com/cybersecurity/advisories/ensa-2024-3

Get alerted when CVE-2024-21878 or the next vulnerability affects your stack