{"id":"CVE-2023-29114","state":"PUBLISHED","title":"Unauthorized System Log Disclosure in Enel X JuiceBox","description":"System logs could be accessed through web management application due to a lack of access control.\n\n\nAn attacker can obtain the following sensitive information:\n\n•     Wi-Fi access point credentials to which the EV charger can connect.\n\n•     APN web address and credentials.\n\n•     IPSEC credentials.\n\n•     Web interface access credentials for user and admin accounts.\n\n•     JuiceBox system components (software installed, model, firmware version, etc.).\n\n•     C2G configuration details.\n\n•     Internal IP addresses.\n\n•     OTA firmware update configurations (DNS servers).\n\nAll the credentials are stored in logs in an unencrypted plaintext format.","publishedAt":"2024-11-05T15:01:08.666Z","updatedAt":"2024-11-05T17:00:26.636Z","severity":{"score":5.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"ASRG"},"assigner":"ASRG","products":["Enel X JuiceBox Pro 3.0 22kW Cellular"],"affected":[{"vendor":"Enel X","product":"JuiceBox Pro 3.0 22kW Cellular","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.1.1.0_JB3VU096A","versionType":"custom"}],"modules":["Web Manager interface"]}],"references":["https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/29xxx/CVE-2023-29114.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-29114","state":"PUBLISHED","datePublished":"2024-11-05T15:01:08.666Z","dateUpdated":"2024-11-05T17:00:26.636Z","assignerShortName":"ASRG","assignerOrgId":"c15abc07-96a9-4d11-a503-5d621bfe42ba","dateReserved":"2023-03-31T10:22:52.667Z"},"containers":{"cna":{"title":"Unauthorized System Log Disclosure in Enel X JuiceBox","descriptions":[{"lang":"en","value":"System logs could be accessed through web management application due to a lack of access control.\n\n\nAn attacker can obtain the following sensitive information:\n\n•     Wi-Fi access point credentials to which the EV charger can connect.\n\n•     APN web address and credentials.\n\n•     IPSEC credentials.\n\n•     Web interface access credentials for user and admin accounts.\n\n•     JuiceBox system components (software installed, model, firmware version, etc.).\n\n•     C2G configuration details.\n\n•     Internal IP addresses.\n\n•     OTA firmware update configurations (DNS servers).\n\nAll the credentials are stored in logs in an unencrypted plaintext format."}],"affected":[{"vendor":"Enel X","product":"JuiceBox Pro 3.0 22kW Cellular","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.1.1.0_JB3VU096A","versionType":"custom"}],"modules":["Web Manager interface"]}],"references":[{"url":"https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ASRG","orgId":"c15abc07-96a9-4d11-a503-5d621bfe42ba","dateUpdated":"2024-11-05T15:01:08.666Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Abdellah Benotsmane (PCAutomotive)"}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-05T17:00:16.930334Z","id":"CVE-2023-29114","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-05T17:00:26.636Z"}}]}}}