CVE-2023-32274 HIGH

CVE-2023-32274: Enphase Installer Toolkit Android App Use of Hard-coded Credentials

Vendor Enphase
Product Enphase Installer Toolkit
Weakness CWE-798 · Hardcoded credentials
Published June 20, 2023
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.

Key dates

02Disclosure timeline

June 20, 2023 CVE published
December 6, 2024 Record updated