Frank Breedijk (DIVD)

Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x

A backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code execution.

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script.

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Buffer overflow vulnerabilities in CGI scripts lead to segfault

Arbitrary file download using <redacted>.sh

Authenticated arbitrary file upload to /tmp/ and /tmp/upload/

When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station.