Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Enel X Component: Waybox Pro Firmware Clear all filters
TI-2023-13566 CVE-2023-29126 · GHSA-6j2q-qr5r-m5gg

Insecure loose comparison in Enel X JuiceBox

Priority LOW 38

The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00259 Published 2024-11-05 No fix listed CWE-1287
TI-2023-13565 CVE-2023-29125 · GHSA-fq9r-775m-mfr3

Heap overflow in CM_main.exe binary in Enel X JuiceBox

Priority MEDIUM 41

A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.

CVSS 3.1CRITICAL 9.0 Adjacent network Low privileges No interaction EPSS 0.00302 Published 2024-11-05 No fix listed CWE-122
TI-2023-13563 CVE-2023-29121 · GHSA-r2xm-57h8-c29j

Exposed TCF agent service in Enel X Juicebox

Priority MEDIUM 43

Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.

CVSS 3.1CRITICAL 9.6 Adjacent network No auth No interaction EPSS 0.00279 Published 2024-11-05 No fix listed CWE-284
TI-2023-13562 CVE-2023-29120 · GHSA-hx43-x8j5-92gq

Unauthorized Remote Command Execution in Enel X Juicebox

Priority MEDIUM 43

Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.

CVSS 3.1CRITICAL 9.6 Adjacent network No auth No interaction EPSS 0.00338 Published 2024-11-05 No fix listed CWE-78
TI-2023-13561 CVE-2023-29119 · GHSA-9hvc-wrqf-m74c

Unauthorized SQLite Injection

Priority MEDIUM 43

Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.

CVSS 3.1CRITICAL 9.6 Adjacent network No auth No interaction EPSS 0.00338 Published 2024-11-05 No fix listed CWE-89
TI-2023-13560 CVE-2023-29118 · GHSA-q634-78mh-cmgq

Unauthorized SQLite Injection in Enel X Juicebox

Priority MEDIUM 43

Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.

CVSS 3.1CRITICAL 9.6 Adjacent network No auth No interaction EPSS 0.00338 Published 2024-11-05 No fix listed CWE-89
TI-2023-13559 CVE-2023-29117 · GHSA-5wr9-cjhq-wwg7

Authentication Bypass in JuiceBox Web Manager interface

Priority MEDIUM 40

Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00323 Published 2024-11-05 No fix listed CWE-287
TI-2023-13558 CVE-2023-29116 · GHSA-pccx-2485-w69f

PHP Information Disclosure in Enel X JuiceBox

Priority LOW 20

Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained.

CVSS 3.1MEDIUM 4.3 Adjacent network No auth No interaction EPSS 0.0023 Published 2024-11-05 Fixed in 2.1.1.0_JB3VU096A CWE-200
TI-2023-13557 CVE-2023-29115 · GHSA-gg8c-h9qw-qwrh

Denial of Service via Web Management interface in Enel X JuiceBox

Priority LOW 29

In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00282 Published 2024-11-05 Fixed in 2.1.1.0_JB3VU096A CWE-284