Hardcoded Login Password Vulnerability in Enphase Envoy Devices

CVE-2020-25752

What is CVE-2020-25752?

A security issue exists in Enphase Envoy R3.x and D4.x devices where hardcoded passwords for the installer and Enphase accounts are used. These passwords are derived from the MD5 hash of the username concatenated with the serial number, alongside static strings, making it possible for an unauthenticated user to obtain the serial number through the /info.xml endpoint. As these passwords are not modifiable by users and can be easily calculated by attackers, this creates a substantial security risk, potentially leading to unauthorized access.

References