CVE-2023-29114 | THREATINT

Assigner	ASRG
Reserved	2023-03-31
Published	2024-11-05
Updated	2024-11-05

Description

System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information: • Wi-Fi access point credentials to which the EV charger can connect. • APN web address and credentials. • IPSEC credentials. • Web interface access credentials for user and admin accounts. • JuiceBox system components (software installed, model, firmware version, etc.). • C2G configuration details. • Internal IP addresses. • OTA firmware update configurations (DNS servers). All the credentials are stored in logs in an unencrypted plaintext format.

MEDIUM: 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Product status

Default status

unaffected

Any version before 2.1.1.0_JB3VU096A

affected

Credits

Abdellah Benotsmane (PCAutomotive) finder

References

https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf

cve.org CVE-2023-29114

nvd.nist.gov CVE-2023-29114

Download JSON

https://cve.threatint.com/CVE/CVE-2023-29114

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.