Carlo Gavazzi EOS Box SQL Injection
Priority LOW 37CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Complete · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The Carlo Gavazzi EOS-Box does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
Why it matters now
EPSS 0.01333 71st percentileScored 2026-11-07
Fix Fixed EOS-Box (Carlo Gavazzi Automation): 1.0.0.1080_2.1.10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Carlo Gavazzi Automation | EOS-Box | before 1.0.0.1080_2.1.10 | 1.0.0.1080_2.1.10 | Patch available | CNA |
- EOS-Box VendorCarlo Gavazzi Automation Affected before 1.0.0.1080_2.1.10 Fixed in 1.0.0.1080_2.1.10 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:carlosgavazzi:eos-box_photovoltaic_monitoring_system_firmware:*:*:*:*:*:*:*:* | up to 1.0.0 | Vulnerable | Carlo Gavazzi Automation |
| cpe:2.3:h:carlosgavazzi:eos-box_photovoltaic_monitoring_system:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Carlo Gavazzi Automation |
- cpe:2.3:o:carlosgavazzi:eos-box_photovoltaic_monitoring_system_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.0 Vulnerable ·Carlo Gavazzi Automation
- cpe:2.3:h:carlosgavazzi:eos-box_photovoltaic_monitoring_system:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Carlo Gavazzi Automation
Remediation
- Fix · CNA EOS-Box (Carlo Gavazzi Automation) Fixed in 1.0.0.1080_2.1.10
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Carlo Gavazzi Automation EOS-Box 1.0.0.1080_2.1.10
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2012-05175 Carlo Gavazzi EOS Box Hard-Coded CredentialsPriority MEDIUM 46
Timeline
- 2026-10-02 Threatist record created from CVE-2012-6427
- 2026-10-03 Alias added: GHSA-7qc4-45cg-h6f3
References
More Carlo Gavazzi Automation Eos-box Photovoltaic Monitoring System vulnerabilities
- TI-2012-05175 Carlo Gavazzi EOS Box Hard-Coded Credentials CVSS 2.0CRITICAL 10.0
Sources
- CVE-2012-6427 · CVE Program
- CVE-2012-6427 · NVD
- FIRST EPSS
- GHSA-7qc4-45cg-h6f3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences