CVE-2024-21880: URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-12 · updated 2026-06-17
Weakness: CWE-77

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x

Affected products

Enphase IQ Gateway: from 4.0 through 7.3.120

References

https://csirt.divd.nl/CVE-2024-21880
https://csirt.divd.nl/DIVD-2024-00011
https://enphase.com/cybersecurity/advisories/ensa-2024-5

Get alerted when CVE-2024-21880 or the next vulnerability affects your stack