CVE-2020-25752

Vulnerability

An issue discovered in Enphase Envoy R3.x and D4.x devices uses hardcoded passwords for the web-panel installer and Enphase accounts [1]. The passwords are derived from an MD5 hash of the username and serial number mixed with static strings. The serial number can be retrieved by an unauthenticated user at /info.xml [1]. Users cannot change these passwords [1].

Exploitation

An attacker can access the serial number via an unauthenticated request to /info.xml [1]. Using the MD5 hash of the username and serial number with known static strings, the attacker can compute the passwords [1]. No authentication or user interaction is required to obtain the serial number [1].

Impact

Successful exploitation grants the attacker access to the Envoy web panel with installer or Enphase account privileges [1]. This allows full system monitoring and management control, potentially compromising the confidentiality and integrity of the solar energy system [1].

Mitigation

As the passwords are hardcoded and users cannot change them, the device is at risk [1]. Enphase has not publicly released a fix for this issue in the available references [1]. Affected users should monitor vendor advisories for firmware updates [1].