Medium severity6.5NVD Advisory· Published Aug 12, 2024· Updated Jun 17, 2026

CVE-2024-21877

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Enphase/Envoyllm-fuzzy2 versions
4.x to 8.0 and < 8.2.4225+ 1 more
- (no CPE)range: 4.x to 8.0 and < 8.2.4225
- (no CPE)range: 8.0
Enphase/IQ Gatewayllm-fuzzy
Range: 4.x to 8.0 and < 8.2.4225

Patches

Vulnerability mechanics

References

csirt.divd.nl/CVE-2024-21877nvdThird Party Advisory
csirt.divd.nl/DIVD-2024-00011nvdThird Party Advisory
enphase.com/cybersecurity/advisories/ensa-2024-2nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000