On 20 June 2023 CISA published two advisories on Enphase products, as reported by SecurityWeek. Both issues were reported by a researcher using the handle OBSWCY3F, and both were described as remotely exploitable with low attack complexity.
Safeguard does not operate energy equipment. The cases show where supplier software risk sits beyond the device itself.
What's affected
- CVE-2023-32274, CVSS 8.6: Enphase Installer Toolkit for Android, version 3.27.0 and older, contains hardcoded credentials that an attacker could use to access sensitive data. Version 3.30.0 is available for Android and iOS.
- CVE-2023-33869: Enphase Envoy communication gateway, version D7.0.88, has a command injection flaw that could allow root access and command execution.
SecurityWeek reported that CISA said Enphase had not responded to requests to work on the issues. Enphase then said it was in direct contact with CISA, and on 27 June said it was working on mitigations.
What to do now
- If you install or manage these products, update the installer app to 3.30.0 or later and check the vendor and CISA pages for gateway status, since fix status here may have changed since 2023.
- If you build apps used by field technicians, search the code and build artifacts for embedded credentials. Rotate any you find.
- Put the gateway on a network segment, and avoid exposing it to the internet.
- Keep a list of vendor products at each site with their versions.
Why it matters
The risky part was a tool used by installers, not the product on the roof. Companion apps hold credentials and reach many sites at once. Scanning mobile and desktop tools for secrets belongs next to scanning the firmware.
Quick check
Which version of the Installer Toolkit carries the fix for CVE-2023-32274?
Version 3.30.0 is reported as available for Android and iOS.
