CVE-2020-25754

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Use of Password Hash With Insufficient Computational Effort pada enphase envoy firmware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Attempts to change the user password via passwd or other tools have no effect.

Rincian

Terbit di NVD

16 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://enphase.com/en-us/products-and-services/envoy-and-combiner product · advisory vendor
• https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322... exploit · advisory pihak ketiga
• https://stage2sec.com advisory pihak ketiga