Vulnerability · Published Jun 16, 2021 · Assigned by mitre

CVE-2020-25752

Medium 5.3

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.6%top 24.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://enphase.com/en-us/products-and-services/envoy-and-combiner x_refsource_MISC
https://stage2sec.com x_refsource_MISC
https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a x_refsource_MISC