CVE-2020-25754

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Attempts to change the user password via passwd or other tools have no effect.

• CWE-916

• https://enphase.com/en-us/products-and-services/envoy-and-combinerProduct, Vendor Advisory
• https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661aExploit, Third Party Advisory
• https://stage2sec.comThird Party Advisory
• https://enphase.com/en-us/products-and-services/envoy-and-combinerProduct, Vendor Advisory
• https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661aExploit, Third Party Advisory
• https://stage2sec.comThird Party Advisory

Published

Jun 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25749The Telnet service of Rubetek cameras RV-3406, RV-3409, and …9.8
• CVE-2020-2575Vulnerability in the Oracle VM VirtualBox product of Oracle …7.5
• CVE-2020-25750An issue was discovered in DotPlant2 before 2020-09-14. In c…7.5
• CVE-2020-25751The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Inje…8.8
• CVE-2020-25752An issue was discovered on Enphase Envoy R3.x and D4.x devic…5.3
• CVE-2020-25753An issue was discovered on Enphase Envoy R3.x and D4.x devic…9.8
• CVE-2020-25755An issue was discovered on Enphase Envoy R3.x and D4.x (and …8.8
• CVE-2020-25756A buffer overflow vulnerability exists in the mg_get_http_he…9.8
• CVE-2020-25757A lack of input validation and access controls in Lua CGIs o…8.8
• CVE-2020-25758An issue was discovered on D-Link DSR-250 3.17 devices. Insu…8.8
• CVE-2020-25759An issue was discovered on D-Link DSR-250 3.17 devices. Cert…8.8
• CVE-2020-2576Vulnerability in the Oracle Outside In Technology product of…6.5