Priority MEDIUM 42
The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01106 · Published 2024-04-12 · No fix listed CWE-121
Priority MEDIUM 48
Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03245 · Published 2018-11-02 · No fix listed CWE-522
Priority MEDIUM 49
Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03805 · Published 2018-11-02 · No fix listed CWE-288
Priority LOW 32
An issue was discovered in CIRCONTROL CirCarLife before 4.3.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0172 · Published 2018-09-26 · No fix listed CWE-200
Priority LOW 35
An issue was discovered in CIRCONTROL CirCarLife before 4.3.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.08851 · Published 2018-09-18 · No fix listed CWE-200
Priority MEDIUM 45
An issue was discovered in CIRCONTROL CirCarLife before 4.3.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.24568 · Published 2018-09-18 · No fix listed CWE-287
Priority MEDIUM 46
An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02144 · Published 2018-09-18 · No fix listed CWE-522
Priority LOW 36
An issue was discovered in CIRCONTROL CirCarLife before 4.3.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.09512 · Published 2018-09-18 · No fix listed CWE-287
Priority LOW 34
CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00876 · Published 2018-06-22 · No fix listed CWE-20
Priority HIGH 75
CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.56401 · Published 2018-06-22 · No fix listed CWE-200
THREATIST.IORead the docs