CISA: Enphase ignores reports about vulnerabilities in Envoy

Gandalf_The_Grey · Jun 21, 2023

(Translated from Dutch with DeepL):

Enphase Energy, manufacturer of microinverters, energy monitoring and energy storage systems, has ignored notifications about several vulnerabilities in its products, the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) claims. Through the security holes, caused in part by a hard-coded password, an attacker can steal sensitive information.

The problems occur with the Enphase Envoy, a solution that measures power production from solar panels. Enphase Envoy version D7.0.88 and earlier are vulnerable to command injection, which allows an attacker to execute commands with root privileges. In addition, the Enphase Installer Toolkit for Android, version 3.27.0 and earlier, contains a hard-coded password.

With the toolkit, it is possible to install the Envoy. Through the hardcoded password, an attacker can steal sensitive data, CISA said. The impact of this vulnerability was rated 8.6 on a scale of 1 to 10. Command injection received an impact score of 6.3.

CISA informed Enphase of the vulnerabilities, but the company would not cooperate in fixing the problems, the U.S. government agency said. A new version of the Android app has since been released, but whether it is no longer vulnerable is unknown. On Enphase's forum, users have since also asked questions, but no answers have yet been given.
Click to expand...

https://www.security.nl/posting/800380/CISA: Enphase negeert meldingen over kwetsbaarheden in Envoy

Log in or Sign up

CISA: Enphase ignores reports about vulnerabilities in Envoy

Gandalf_The_Grey Registered Member

Log in or Sign up

CISA: Enphase ignores reports about vulnerabilities in Envoy

Gandalf_The_Grey Registered Member

Useful Searches