CVE-2023-29121 Exposed TCF agent service in Enel X Juicebox
An exposed TCF agent service allows attackers to gain administrator privileges on Enel X JuiceBox EV charging stations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29121?
CVE-2023-29121 is a critical missing authorization vulnerability in Enel X JuiceBox Pro 3.0 22kW Cellular, published on 5 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
Weakness: CWE-284
Which versions are affected by CVE-2023-29121?
It affects 1 product.
Products include Enelx Waybox Pro Firmware.
How do I fix CVE-2023-29121?
No fix has been published for CVE-2023-29121 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-29121 being exploited?
There is no known exploitation of CVE-2023-29121 in the wild and no public exploit code.
Other vulnerabilities in Enel X JuiceBox Pro 3.0 22kW Cellular
- CVE-2023-29118 Unauthorized SQLite Injection in Enel X Juicebox
- CVE-2023-29119 Unauthorized SQLite Injection
- CVE-2023-29120 Unauthorized Remote Command Execution in Enel X Juicebox
- CVE-2023-29125 Heap overflow in CM_main.exe binary in Enel X JuiceBox
- CVE-2023-29117 Authentication Bypass in JuiceBox Web Manager interface
Sources
Also known as GHSA-r2xm-57h8-c29j.