CVE-2012-6428 Carlo Gavazzi EOS Box Hard-Coded Credentials
Attackers can use hard-coded credentials to gain administrative access to Carlo Gavazzi EOS Box devices, compromising industrial automation systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-6428?
CVE-2012-6428 is a critical vulnerability in Carlo Gavazzi Automation EOS-Box, published on 23 Dec 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Carlo Gavazzi EOS-Box
stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.
Which versions are affected by CVE-2012-6428?
It affects 2 products.
Products include Carlosgavazzi Eos-Box Photovoltaic Monitoring System, Carlosgavazzi Eos-Box Photovoltaic Monitoring System Firmware.
How do I fix CVE-2012-6428?
No fix has been published for CVE-2012-6428 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-6428 being exploited?
There is no known exploitation of CVE-2012-6428 in the wild and no public exploit code.
Other vulnerabilities in Carlo Gavazzi Automation EOS-Box
Sources
Also known as GHSA-mp78-772x-4r85.