TI-2023-13563 CVE-2023-29121 · GHSA-r2xm-57h8-c29j
Exposed TCF agent service in Enel X Juicebox
Priority MEDIUM 43
Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
Enel X
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Enel X records in CISA KEVNo Enel X vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records
TI-2023-13562 CVE-2023-29120 · GHSA-hx43-x8j5-92gq
Unauthorized Remote Command Execution in Enel X Juicebox
Priority MEDIUM 43
Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.
TI-2023-13561 CVE-2023-29119 · GHSA-9hvc-wrqf-m74c
Unauthorized SQLite Injection
Priority MEDIUM 43
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
TI-2023-13560 CVE-2023-29118 · GHSA-q634-78mh-cmgq
Unauthorized SQLite Injection in Enel X Juicebox
Priority MEDIUM 43
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
TI-2026-00561 CVE-2026-0778 · GHSA-w47c-mgm4-6rq8
Missing authentication in Enel X JuiceBox 40
Priority MEDIUM 41
Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability.
TI-2023-13565 CVE-2023-29125 · GHSA-fq9r-775m-mfr3
Heap overflow in CM_main.exe binary in Enel X JuiceBox
Priority MEDIUM 41
A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.
TI-2023-13559 CVE-2023-29117 · GHSA-5wr9-cjhq-wwg7
Authentication Bypass in JuiceBox Web Manager interface
Priority MEDIUM 40
Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.
TI-2023-13566 CVE-2023-29126 · GHSA-6j2q-qr5r-m5gg
Insecure loose comparison in Enel X JuiceBox
Priority LOW 38
The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.
TI-2023-13564 CVE-2023-29122 · GHSA-gq6w-g8w8-jh8j
Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
Priority LOW 31
Under certain conditions, access to service libraries is granted to account they should not have access to.
TI-2023-13557 CVE-2023-29115 · GHSA-gg8c-h9qw-qwrh
Denial of Service via Web Management interface in Enel X JuiceBox
Priority LOW 29
In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g.
TI-2023-13556 CVE-2023-29114 · GHSA-m9fp-x7x4-9799
Unauthorized System Log Disclosure in Enel X JuiceBox
Priority LOW 25
System logs could be accessed through web management application due to a lack of access control.
TI-2023-13558 CVE-2023-29116 · GHSA-pccx-2485-w69f
PHP Information Disclosure in Enel X JuiceBox
Priority LOW 20
Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained.