PT-2021-11176 · Enphase · Enphase Envoy

Published 2021-06-16 · Updated 2021-06-24 · CVE-2020-25752

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Enphase Envoy versions R3.x and D4.x

Description: An issue was discovered where hardcoded web-panel login passwords for the installer and Enphase accounts are derived from the MD5 hash of the username and serial number mixed with static strings. The serial number can be retrieved by an unauthenticated user at the "/info.xml" API endpoint. These passwords can be easily calculated by an attacker, and users are unable to change them.

Recommendations: For Enphase Envoy versions R3.x and D4.x, consider disabling the web-panel login feature until a patch is available to prevent exploitation. Restrict access to the "/info.xml" API endpoint to minimize the risk of serial number retrieval. Avoid using the hardcoded passwords for the installer and Enphase accounts until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-25752

Affected Products

Enphase Envoy

References · 5

• 🔥 https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a · Exploit
• https://osv.dev/vulnerability/CVE-2020-25752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25752 · Security Note
• https://enphase.com/en-us/products-and-services/envoy-and-combiner · Vendor Advisory
• https://stage2sec.com · Note