Enphase Envoy-S (ENV-S-AM1-120)
From Wiki-IoT
Revision as of 23:47, 24 October 2026 by Jeandecian (talk | contribs)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Enphase Envoy-S (ENV-S-AM1-120) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Enphase Envoy-S (ENV-S-AM1-120)
Brand: Enphase Category: Gateway • Model / Gen: ENV-S-AM1-120 Release Date: 2018-01-01 • Status: In sale Classification Date: 2026-10-24 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | — | Sealed gateway; no documented hardware tampering. |
| Known vulnerabilities | Very common | — | 14 CVEs, incl. CVE-2024-21876/21878 (chainable unauthenticated RCE) and CVE-2020-25754/25755. Source: nvd.nist.gov/vuln/detail/CVE-2024-21876 |
| Prior attacks | Rare | — | DIVD scanned for and notified exposed gateways; actively targeted on exposed networks. Source: csirt.divd.nl/cases/DIVD-2024-00011/ |
| Updatability | Rare | — | Firmware is pushed by Enphase; end users cannot update, and updates are infrequent. Source: nvd.nist.gov/vuln/detail/CVE-2020-25754 |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | — | Historically weak device authentication — default password derivable from serial (CVE-2020-25754). Source: nvd.nist.gov/vuln/detail/CVE-2020-25754 |
| Communications | Encrypted with obselete encryption | — | Weak/legacy encryption in places (CVE-2024-21881 'weak encryption'). |
| Storage | No encryption | — | Local configuration and credentials are not strongly encrypted. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | — | Basic installer/homeowner accounts with limited separation. |
| Authentication | Basic | — | Password login undermined by the derivable-default-password flaw. |
| Brute-force protection | Absent | — | No login rate-limiting. |
| Event logging | Partial logging | — | Partial logging of system events. |
| Passwords | Default/Common/Easy to guess | — | Default password derivable from the serial number (CVE-2020-25754). Source: nvd.nist.gov/vuln/detail/CVE-2020-25754 |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | (Companion App: ) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: • Power: • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
