Juicebox Pro3.0 22kw Cellular CVEs and Security Vulnerabilities

CVE-2023-29122

Incorrect file ownership of privileged service's libraries in Enel X JuiceBox

Under certain conditions, access to service libraries is granted to account they should not have access to.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Enel X

Products

Juicebox Pro3.0 22kw Cellular

CVE-2023-29125

Heap overflow in CM_main.exe binary in Enel X JuiceBox

A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Enel X Enelx

Products

Juicebox Pro3.0 22kw Cellular Waybox Pro Waybox Pro Firmware

CVE-2023-29121

Exposed TCF agent service in Enel X Juicebox

Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Enel X Enelx

Products

Juicebox Pro3.0 22kw Cellular Waybox Pro Waybox Pro Firmware

CVE-2023-29120

Unauthorized Remote Command Execution in Enel X Juicebox

Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Enel X Enelx

Products

Juicebox Pro3.0 22kw Cellular Waybox Pro Waybox Pro Firmware

CVE-2023-29119

Unauthorized SQLite Injection

Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Enel X Enelx

Products

Juicebox Pro3.0 22kw Cellular Waybox Pro Waybox Pro Firmware

CVE-2023-29118

Unauthorized SQLite Injection in Enel X Juicebox

Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Enel X Enelx

Products

Juicebox Pro3.0 22kw Cellular Waybox Pro Waybox Pro Firmware

CVE-2023-29117

Authentication Bypass in JuiceBox Web Manager interface

Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Enel X Enelx

Products

Juicebox Pro3.0 22kw Cellular Waybox Pro Waybox Pro Firmware

Search vulnerabilities

Incorrect file ownership of privileged service's libraries in Enel X JuiceBox

Heap overflow in CM_main.exe binary in Enel X JuiceBox

Exposed TCF agent service in Enel X Juicebox

Unauthorized Remote Command Execution in Enel X Juicebox

Unauthorized SQLite Injection

Unauthorized SQLite Injection in Enel X Juicebox

Authentication Bypass in JuiceBox Web Manager interface