CVE-2023-29114

Description

System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information: •     Wi-Fi access point credentials to which the EV charger can connect. •     APN web address and credentials. •     IPSEC credentials. •     Web interface access credentials for user and admin accounts. •     JuiceBox system components (software installed, model, firmware version, etc.). •     C2G configuration details. •     Internal IP addresses. •     OTA firmware update configurations (DNS servers). All the credentials are stored in logs in an unencrypted plaintext format.

Reserved 2023-03-31 | Published 2024-11-05 | Updated 2024-11-05 | Assigner ASRG

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

Any version before 2.1.1.0_JB3VU096A
affected

Credits

Abdellah Benotsmane (PCAutomotive) finder

References

support-emobility.enelx.com/...urity-Bulletin-06-2024-V1.pdf

cve.org (CVE-2023-29114)

nvd.nist.gov (CVE-2023-29114)

Download JSON