CVE-2023-29114 Unauthorized System Log Disclosure in Enel X JuiceBox
An attacker can access system logs via the web interface to obtain plaintext credentials and sensitive configuration data from the Enel X JuiceBox EV charger.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29114?
CVE-2023-29114 is a medium-severity vulnerability in Enel X JuiceBox Pro 3.0 22kW Cellular, published on 5 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
System logs could be accessed through web management application due to a lack of access control.
An attacker can obtain the following sensitive information:
• Wi-Fi access point credentials to which the EV charger can connect.
• APN web address and credentials.
• IPSEC credentials.
• Web interface access credentials for user and admin accounts.
• JuiceBox system components (software installed, model, firmware version, etc.).
• C2G configuration details.
• Internal IP addresses.
• OTA firmware update configurations (DNS servers).
All the credentials are stored in logs in an unencrypted plaintext format.
Weakness: CWE-200
Which versions are affected by CVE-2023-29114?
How do I fix CVE-2023-29114?
No fix has been published for CVE-2023-29114 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-29114 being exploited?
There is no known exploitation of CVE-2023-29114 in the wild and no public exploit code.
Sources
Also known as GHSA-m9fp-x7x4-9799.