CVE-2023-29115 Denial of Service via Web Management interface in Enel X JuiceBox
An attacker can cause a denial of service, such as a reboot, by sending specific requests to the Enel X JuiceBox web management interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29115?
CVE-2023-29115 is a medium-severity denial of service vulnerability in Enel X JuiceBox Pro 3.0 22kW Cellular, published on 5 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).
Weakness: CWE-284
Which versions are affected by CVE-2023-29115?
It affects 1 product.
Products include Enelx Waybox Pro Firmware.
How do I fix CVE-2023-29115?
No fix has been published for CVE-2023-29115 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-29115 being exploited?
There is no known exploitation of CVE-2023-29115 in the wild and no public exploit code.
Other vulnerabilities in Enel X JuiceBox Pro 3.0 22kW Cellular
- CVE-2023-29118 Unauthorized SQLite Injection in Enel X Juicebox
- CVE-2023-29119 Unauthorized SQLite Injection
- CVE-2023-29120 Unauthorized Remote Command Execution in Enel X Juicebox
- CVE-2023-29121 Exposed TCF agent service in Enel X Juicebox
- CVE-2023-29125 Heap overflow in CM_main.exe binary in Enel X JuiceBox
Sources
Also known as GHSA-gg8c-h9qw-qwrh.