NVD Vulnerability Detail

CVE-2020-25752

Summary	An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.
Publication Date	June 17, 2021, 4:15 a.m.
Registration Date	June 17, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 2:18 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:enphase:envoy_firmware:d4.0:::::::*
cpe:2.3:o:enphase:envoy_firmware:r3.0:::::::*
execution environment
1	cpe:2.3:h:enphase:envoy:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://enphase.com/en-us/products-and-services/envoy-and-combiner	Product Vendor Advisory
2	https://enphase.com/en-us/products-and-services/envoy-and-combiner	Product Vendor Advisory
3	https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a	Exploit Third Party Advisory
4	https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a	Exploit Third Party Advisory
5	https://stage2sec.com	Third Party Advisory
6	https://stage2sec.com	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-798	ハードコードされた認証情報の使用	https://cwe.mitre.org/data/definitions/798.html

JVN Vulnerability Information

Enphase Envoy におけるハードコードされた認証情報の使用に関する脆弱性

Title	Enphase Envoy におけるハードコードされた認証情報の使用に関する脆弱性
Summary	Enphase Envoy には、ハードコードされた認証情報の使用に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 17, 2021, midnight
Registration Date	March 14, 2022, 4:16 p.m.
Last Update	March 14, 2022, 4:16 p.m.

Affected System

Enphase Energy

Envoy D4.x

Envoy R3.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-25752	https://www.cve.org/CVERecord?id=CVE-2020-25752
National Vulnerability Database (NVD)
2	CVE-2020-25752	https://nvd.nist.gov/vuln/detail/CVE-2020-25752

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-798	https://cwe.mitre.org/data/definitions/798.html

ベンダー情報

No	Name	URL
Enphase Energy
1	Communication	https://enphase.com/en-us/products-and-services/envoy-and-combiner

その他

No	Name	URL
関連文書
1	Can solar controllers be used to generate fake clean energy credits?	https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a

Change Log

No	Changed Details	Date of change
1	[2022年03月14日] 掲載	March 14, 2022, 4:16 p.m.