CVE Published: 05/11/2024 |
CVE Updated: 05/11/2024 |
CVE Year: 2023 Source: ASRG |
Vendor: Enel X |
Product: JuiceBox Pro 3.0 22kW Cellular Status : PUBLISHED
CVE-2023-29114 Description
System logs could be accessed through web management application due to a lack of access control.
An attacker can obtain the following sensitive information:
• Wi-Fi access point credentials to which the EV charger can connect.
• APN web address and credentials.
• IPSEC credentials.
• Web interface access credentials for user and admin accounts.
• JuiceBox system components (software installed, model, firmware version, etc.).
• C2G configuration details.
• Internal IP addresses.
• OTA firmware update configurations (DNS servers).
All the credentials are stored in logs in an unencrypted plaintext format.
Metrics
CVSS Version: 3.1 |
Base Score: 5.7 MEDIUM Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N