Back to Database
Status published
High
CVE-2024-21881
Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
Vulnerability Description
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-21881
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Wietse Boonstra (DIVD)
- Hidde Smit (DIVD)
- Frank Breedijk (DIVD)
- Max van der Horst (DIVD)
References
More from Enphase
View All →CVE-2024-21880
URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x
High
8.6
CVE-2024-21879
URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225
High
8.7
CVE-2024-21878
Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x
Critical
9.2
CVE-2024-21877
Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225
Critical
9.2
CVE-2024-21876
Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225
Critical
9.2
Affected Vendor
Enphase
View all reports →Affected Software
Envoy
Vulnerable Versions:
5.x, 4.x
Timeline
Official Publish:
August 10th, 2024
Last Modified:
March 11th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.