High severity8.8NVD Advisory· Published Aug 12, 2024· Updated Jun 17, 2026

CVE-2024-21879

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Enphase/Envoyllm-fuzzy2 versions
from 4.x to 8.x and < 8.2.4225+ 1 more
- (no CPE)range: from 4.x to 8.x and < 8.2.4225
- (no CPE)range: 8.x
Enphase/IQ Gatewayllm-fuzzy
Range: from 4.x to 8.x and < 8.2.4225

Patches

Vulnerability mechanics

References

csirt.divd.nl/CVE-2024-21879nvdThird Party Advisory
csirt.divd.nl/DIVD-2024-00011nvdThird Party Advisory
enphase.com/cybersecurity/advisories/ensa-2024-4nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000