PT-2023-23694 · Enphase · Enphase Installer Toolkit

Published 2023-06-20 · Updated 2023-06-28 · CVE-2023-32274

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Enphase Installer Toolkit version 3.27.0

Description The issue concerns hard-coded credentials embedded in the binary code of the Android application. An attacker can exploit this to gain access to sensitive information.

Recommendations For Enphase Installer Toolkit version 3.27.0, consider removing or securely storing the hard-coded credentials to prevent unauthorized access. As a temporary workaround, restrict access to sensitive information until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-32274

Affected Products

Enphase Installer Toolkit

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-32274 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32274 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-23-171-02 · Note
• https://t.me/cvenotify/52733 · Telegram Post