CVE-2020-25754

Vulnerability

The Enphase Envoy devices running firmware R3.x and D4.x include a custom PAM module that bypasses traditional user authentication. Instead, it validates users using a password derived from the MD5 hash of the username and the device's serial number. The serial number can be retrieved by an unauthenticated attacker via the /info.xml endpoint. This affects all Enphase Envoy models with these firmware versions [1].

Exploitation

An unauthenticated attacker can first obtain the device's serial number by accessing http:///info.xml. Then, knowing the username (e.g., "installer" or default accounts), the attacker can compute the MD5 hash of the concatenation of the username and serial number to derive the password. The attacker can then use this password to gain authenticated access to the device's web interface or other services.

Impact

Successful exploitation allows an attacker to gain unauthorized access to the Envoy device with the same privileges as the legitimate user. This can lead to disclosure of sensitive information such as energy production data, system configuration, and potentially the ability to modify device settings or disrupt monitoring.

Mitigation

Enphase has not released a specific patch as of the publication date. Users are advised to restrict network access to the Envoy devices, ensure they are not exposed to the internet, and monitor for any firmware updates from Enphase. The device is not listed on CISA's Known Exploited Vulnerabilities catalog.