Critical severity9.8NVD Advisory· Published Aug 12, 2024· Updated Jun 17, 2026

CVE-2024-21878

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Enphase/Envoyllm-fuzzy2 versions
from 4.x up to and including 8.x+ 1 more
- (no CPE)range: from 4.x up to and including 8.x
- (no CPE)range: 8.x
Enphase/IQ Gatewayllm-fuzzy
Range: from 4.x up to and including 8.x

Patches

Vulnerability mechanics

References

csirt.divd.nl/CVE-2024-21878nvdThird Party Advisory
csirt.divd.nl/DIVD-2024-00011nvdThird Party Advisory
enphase.com/cybersecurity/advisories/ensa-2024-3nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000