CVE-2020-25755

Name of the Vulnerable Software and Affected Versions: Enphase Envoy versions R3.x and D4.x

Description: An issue allows remote authenticated users to execute arbitrary commands via the force parameter in the upgrade start function, accessible through the "/installer/upgrade start" API endpoint.

Recommendations: For Enphase Envoy versions R3.x and D4.x, as a temporary workaround, consider disabling the upgrade start function until a patch is available. Restrict access to the "/installer/upgrade start" API endpoint to minimize the risk of exploitation. Avoid using the force parameter in the affected API endpoint until the issue is resolved.