CVE-2023-32274 - Vulnerability Details - OpenCVE

Description

Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.

Published: 2023-06-20

Score: 8.6 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Enphase

Enphase Installer Toolkit

unaffected

Version	Status	Constraints
`3.27.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:enphase:installer_toolkit:3.27.0:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

Vendor Workaround

Users of the affected product are encouraged to contact Enphase Energy support https://support.enphase.com/s/contact-us for additional information.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-36528	Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00136.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02

History

Fri, 06 Dec 2024 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Subscriptions

Enphase Installer Toolkit

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-06-20T19:38:42.467Z

Updated: 2024-12-06T21:34:38.813Z

Reserved: 2023-05-25T19:20:22.591Z

Link: CVE-2023-32274

Vulnrichment

Updated: 2024-08-02T15:10:24.324Z

NVD

Status : Modified

Published: 2023-06-20T20:15:09.413

Modified: 2024-11-21T08:03:01.410

Link: CVE-2023-32274

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-798

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32274", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-05-25T19:20:22.591Z", "datePublished": "2023-06-20T19:38:42.467Z", "dateUpdated": "2024-12-06T21:34:38.813Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Enphase Installer Toolkit", "vendor": "Enphase ", "versions": [{"status": "affected", "version": "3.27.0"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "OBSWCY3F reported this vulnerability to CISA."}], "datePublic": "2023-06-20T19:36:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p></p>\n\n<p>Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.</p><br>\n\n<br>\n\n"}], "value": "\n\n\n\n\nEnphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.\n\n\n\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-06-20T19:38:42.467Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02"}], "source": {"discovery": "EXTERNAL"}, "title": "Enphase Installer Toolkit Android App Use of Hard-coded Credentials", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Users of the affected product are encouraged to contact </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://support.enphase.com/s/contact-us\">Enphase Energy support</a><span style=\"background-color: rgb(255, 255, 255);\"> for additional information.</span>\n\n<br>"}], "value": "\nUsers of the affected product are encouraged to contact Enphase Energy support https://support.enphase.com/s/contact-us \u00a0for additional information.\n\n\n"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.324Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-06T21:34:27.327271Z", "id": "CVE-2023-32274", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-06T21:34:38.813Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.324Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32274", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-06T21:34:27.327271Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-06T21:34:34.953Z"}}], "cna": {"title": "Enphase Installer Toolkit Android App Use of Hard-coded Credentials", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "OBSWCY3F reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Enphase ", "product": "Enphase Installer Toolkit", "versions": [{"status": "affected", "version": "3.27.0"}], "defaultStatus": "unaffected"}], "datePublic": "2023-06-20T19:36:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-02"}], "workarounds": [{"lang": "en", "value": "\nUsers of the affected product are encouraged to contact Enphase Energy support https://support.enphase.com/s/contact-us \u00a0for additional information.\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Users of the affected product are encouraged to contact </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://support.enphase.com/s/contact-us\">Enphase Energy support</a><span style=\"background-color: rgb(255, 255, 255);\"> for additional information.</span>\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\n\n\n\n\nEnphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.\n\n\n\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p></p>\n\n<p>Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.</p><br>\n\n<br>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-06-20T19:38:42.467Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32274", "state": "PUBLISHED", "dateUpdated": "2024-12-06T21:34:38.813Z", "dateReserved": "2023-05-25T19:20:22.591Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-06-20T19:38:42.467Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}