CVE-2024-21876 CRITICAL

CVE-2024-21876: Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225

Vendor Enphase
Product IQ Gateway
Weakness CWE-22 · Path traversal
Published August 10, 2024
Last update March 11, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/V:D/RE:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.

Key dates

02Disclosure timeline

August 10, 2024 CVE published
March 11, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-30159 Kirby vulnerable to path traversal of snippet names in the `snippet()` helper CVE-2025-60722 Microsoft OneDrive for Android Elevation of Privilege Vulnerability CVE-2026-41009 Local Blobstore may allow arbitrary reads/deletes CVE-2023-5212 AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file CVE-2023-22380 Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site