CVE-2024-21876 - CVE House
Back to Database
Status published Critical CVE-2024-21876

Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225

Vulnerability Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-21876

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Wietse Boonstra (DIVD)
  • Hidde Smit (DIVD)
  • Frank Breedijk (DIVD)
  • Max van der Horst (DIVD)

References

More from Enphase

View All →
CVE-2024-21881
Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
High 8.6
CVE-2024-21880
URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x
High 8.6
CVE-2024-21879
URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225
High 8.7
CVE-2024-21878
Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x
Critical 9.2
CVE-2024-21877
Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225
Critical 9.2

Affected Vendor

Affected Software

IQ Gateway
Vulnerable Versions:
8.0, 7.x, 6.x, 5.x, 4.x

Timeline

Official Publish: August 10th, 2024
Last Modified: March 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact