CVE-2020-25755

An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.

• CWE-78

• https://enphase.com/en-us/products-and-services/envoy-and-combinerProduct, Vendor Advisory
• https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661aExploit, Third Party Advisory
• https://stage2sec.comThird Party Advisory
• https://enphase.com/en-us/products-and-services/envoy-and-combinerProduct, Vendor Advisory
• https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661aExploit, Third Party Advisory
• https://stage2sec.comThird Party Advisory

Published

Jun 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2575Vulnerability in the Oracle VM VirtualBox product of Oracle …7.5
• CVE-2020-25750An issue was discovered in DotPlant2 before 2020-09-14. In c…7.5
• CVE-2020-25751The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Inje…8.8
• CVE-2020-25752An issue was discovered on Enphase Envoy R3.x and D4.x devic…5.3
• CVE-2020-25753An issue was discovered on Enphase Envoy R3.x and D4.x devic…9.8
• CVE-2020-25754An issue was discovered on Enphase Envoy R3.x and D4.x devic…7.5
• CVE-2020-25756A buffer overflow vulnerability exists in the mg_get_http_he…9.8
• CVE-2020-25757A lack of input validation and access controls in Lua CGIs o…8.8
• CVE-2020-25758An issue was discovered on D-Link DSR-250 3.17 devices. Insu…8.8
• CVE-2020-25759An issue was discovered on D-Link DSR-250 3.17 devices. Cert…8.8
• CVE-2020-2576Vulnerability in the Oracle Outside In Technology product of…6.5
• CVE-2020-25760Projectworlds Visitor Management System in PHP 1.0 allows SQ…8.8