Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
Priority LOW 31CWE-708Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Under certain conditions, access to service libraries is granted to account they should not have access to.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Enel X | JuiceBox Pro 3.0 22kW Cellular | up to 2.1.1.0_JB3VU096A | — | No fix listed | CNA |
- JuiceBox Pro 3.0 22kW Cellular VendorEnel X Affected up to 2.1.1.0_JB3VU096A Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:enel_x:juicebox_pro3.0_22kw_cellular:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:enel_x:juicebox_pro3.0_22kw_cellular:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-29122
- 2026-10-03 Alias added: GHSA-gq6w-g8w8-jh8j
References
More Enel X vulnerabilities
- TI-2023-13563 Exposed TCF agent service in Enel X Juicebox CVSS 3.1CRITICAL 9.6
- TI-2023-13562 Unauthorized Remote Command Execution in Enel X Juicebox CVSS 3.1CRITICAL 9.6
- TI-2023-13561 Unauthorized SQLite Injection CVSS 3.1CRITICAL 9.6
- TI-2023-13560 Unauthorized SQLite Injection in Enel X Juicebox CVSS 3.1CRITICAL 9.6
- TI-2026-00561 Missing authentication in Enel X JuiceBox 40 CVSS 3.0HIGH 8.8
- TI-2023-13565 Heap overflow in CM_main.exe binary in Enel X JuiceBox CVSS 3.1CRITICAL 9.0
Sources
- CVE-2023-29122 · CVE Program
- CVE-2023-29122 · NVD
- FIRST EPSS
- GHSA-gq6w-g8w8-jh8j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences