CVE-2023-29114

Katalog CVE

CVSS 5.7 · Medium EPSS 0,25%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor. Skor CVSS 3.1 5.7 (Medium) menurut asrg.io.

Deskripsi (NVD)

System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information: •     Wi-Fi access point credentials to which the EV charger can connect. •     APN web address and credentials. •     IPSEC credentials. •     Web interface access credentials for user and admin accounts. •     JuiceBox system components (software installed, model, firmware version, etc.). •     C2G configuration details. •     Internal IP addresses. •     OTA firmware update configurations (DNS servers). All the credentials are stored in logs in an unencrypted plaintext format.

Rincian

Terbit di NVD

5 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

5.7 (Medium), sumber asrg.io
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-...