CVE-2023-29122: medium-severity vulnerability in Enel X JuiceBox Pro 3.0 22kW Cellular
Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A vulnerability in Enel X JuiceBox allows unauthorized user accounts to access libraries that should be restricted to a privileged service. This can lead to unauthorized modification or misuse of critical service components.
CWE-708 (Incorrect Ownership Assignment) affects Enel X JuiceBox service libraries, where file ownership is incorrectly configured under certain conditions, allowing non-privileged accounts read or write access to sensitive service files. Exploitation requires local access and knowledge of the vulnerable library paths; impact includes potential privilege escalation or service compromise through library manipulation.
In the same product, most dangerous first.