CVE-2020-25753
📋 TL;DR
Enphase Envoy solar monitoring devices have a default admin password set to the last 6 digits of the device serial number, which can be retrieved by unauthenticated users via the /info.xml endpoint. This allows attackers to gain administrative access to affected devices. All Enphase Envoy R3.x and D4.x devices running v3 software are vulnerable.
💻 Affected Systems
- Enphase Envoy R3.x
- Enphase Envoy D4.x
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative control of solar monitoring systems, enabling manipulation of energy data, disruption of solar operations, or use as an entry point to internal networks.
Likely Case
Unauthorized access to solar monitoring data and potential manipulation of energy reporting metrics.
If Mitigated
Limited impact if strong network segmentation and access controls prevent external access to the devices.
🎯 Exploit Status
Exploitation requires only retrieving the serial number from /info.xml and using the last 6 digits as admin password.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://enphase.com/en-us/products-and-services/envoy-and-combiner
Restart Required: No
Instructions:
1. Access Envoy admin interface
2. Change default admin password to a strong, unique password
3. Disable unnecessary services/ports
4. Ensure device is not directly internet-accessible
🔧 Temporary Workarounds
Change Admin Password
allManually change the default admin password to a strong, unique password
Access web interface at http://[device-ip]/admin and change password
Restrict Network Access
linuxBlock external access to Envoy devices using firewall rules
iptables -A INPUT -s [device-ip] -p tcp --dport 80 -j DROP
ufw deny from any to [device-ip] port 80
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Envoy devices from untrusted networks
- Monitor for unauthorized access attempts and serial number retrieval from /info.xml endpoint
🔍 How to Verify
Check if Vulnerable:
Access http://[device-ip]/info.xml as unauthenticated user, extract serial number, try last 6 digits as admin password at http://[device-ip]/adminCheck Version:
Check device label or web interface footer for firmware versionVerify Fix Applied:
Attempt to access admin interface with old password (should fail) and verify new strong password works📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful admin login
- Access to /info.xml endpoint from unauthorized sources
Network Indicators:
- Unusual traffic patterns to Envoy admin interface
- External IP addresses accessing /info.xml
SIEM Query:
source_ip=external AND (uri_path="/info.xml" OR uri_path="/admin")🔗 References
- https://enphase.com/en-us/products-and-services/envoy-and-combiner
- https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
- https://stage2sec.com
- https://enphase.com/en-us/products-and-services/envoy-and-combiner
- https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
- https://stage2sec.com
