CVE-2023-29118: falha crítica em Enel X JuiceBox Pro 3.0 22kW Cellular
Unauthorized SQLite Injection in Enel X Juicebox
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.6epss 0.3%
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Enel X · JuiceBox Pro 3.0 22kW CellularCVEs relacionadas — Enel X JuiceBox Pro 3.0 22kW Cellular
No mesmo produto, das mais perigosas para as menos.
CVE-2023-29120CRITICALUnauthorized Remote Command Execution in Enel X JuiceboxEPSS 0.3%CVE-2023-29119CRITICALUnauthorized SQLite InjectionEPSS 0.3%CVE-2023-29117HIGHAuthentication Bypass in JuiceBox Web Manager interfaceEPSS 0.3%CVE-2023-29125CRITICALHeap overflow in CM_main.exe binary in Enel X JuiceBoxEPSS 0.3%CVE-2023-29115MEDIUMDenial of Service via Web Management interface in Enel X JuiceBoxEPSS 0.3%CVE-2023-29121CRITICALExposed TCF agent service in Enel X JuiceboxEPSS 0.3%