CVE-2020-25753

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://enphase.com/en-us/products-and-services/envoy-and-combinerProduct, Vendor Advisory
https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661aExploit, Third Party Advisory
https://stage2sec.comThird Party Advisory
https://enphase.com/en-us/products-and-services/envoy-and-combinerProduct, Vendor Advisory
https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661aExploit, Third Party Advisory
https://stage2sec.comThird Party Advisory

Timeline

Published: Jun 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-257547.5An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents tradit CVE-2020-257558.8An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start a CVE-2020-257569.8A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A craft CVE-2020-257578.8A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system co CVE-2020-257588.8An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authen CVE-2020-257598.8An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an au CVE-2020-25766.5Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version CVE-2020-257608.8Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' p CVE-2020-257616.1Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request paramete CVE-2020-257629.1An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the use CVE-2020-257639.8Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code CVE-2020-257659.8Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Dev