CVE-2020-25752 - CVE House
Back to Database
Status published Medium CVE-2020-25752

An issue was discovered on Enphase Envoy R3.x and D4.x...

Vulnerability Description

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-25752

Credits & Attribution

No credits recorded in the NVD database.

References

More from enphase

View All →
CVE-2020-25755
An issue was discovered on Enphase Envoy R3.x and D4.x...
High 8.8
CVE-2020-25754
An issue was discovered on Enphase Envoy R3.x and D4.x...
High 7.5
CVE-2020-25753
An issue was discovered on Enphase Envoy R3.x and D4.x...
Critical 9.8
CVE-2019-7678
A directory traversal vulnerability was discovered in Enphase Envoy R3.*.*...
Critical 9.8
CVE-2019-7677
XSS exists in Enphase Envoy R3.*.* via the profileName parameter...
Medium 6.1

Affected Vendor

Affected Software

envoy firmware
Vulnerable Versions:
d4.0, r3.0

Timeline

Official Publish: June 16th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.