CVE-2020-25753

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan pada enphase envoy firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml.

Rincian

Terbit di NVD

16 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://enphase.com/en-us/products-and-services/envoy-and-combiner product · advisory vendor
• https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322... exploit · advisory pihak ketiga
• https://stage2sec.com advisory pihak ketiga