User Authentication Bypass in Enphase Envoy Devices

CVE-2020-25754

What is CVE-2020-25754?

A critical flaw has been identified in Enphase Envoy R3.x and D4.x devices, where a custom PAM module for user authentication exposes users to potential security risks. This module circumvents traditional authentication mechanisms by utilizing a password derived from the MD5 hash of the username and serial number, the latter of which can be accessed by unauthenticated users through the /info.xml endpoint. Consequently, attempts to change user passwords using common methods such as 'passwd' are ineffective, leaving devices vulnerable to unauthorized access.

References