CVE-2012-6428

2022-10-0316:15:29

CWE-255

[email protected]

web.nvd.nist.gov

carlo gavazzi

eos-box

firmware

hardcoded accounts

remote access

cve-2012-6428

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.1 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.2%

JSON

Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 establishes multiple hardcoded accounts, which makes it easier for remote attackers to obtain administrative access by reading a password in a PHP script, a similar issue to CVE-2012-5862.

Affected configurations

NVD

Node

carlosgavazzieos-box_photovoltaic_monitoring_system_firmwareRange≤1.0.0

AND

carlosgavazzieos-box_photovoltaic_monitoring_systemMatch-

CPENameOperatorVersion
carlosgavazzi:eos-box_photovoltaic_monitoring_system_firmwarecarlosgavazzi eos-box photovoltaic monitoring system firmwarele1.0.0
carlosgavazzi:eos-box_photovoltaic_monitoring_systemcarlosgavazzi eos-box photovoltaic monitoring systemeq-

CPE	Name	Operator	Version
carlosgavazzi:eos-box_photovoltaic_monitoring_system_firmware	carlosgavazzi eos-box photovoltaic monitoring system firmware	le	1.0.0
carlosgavazzi:eos-box_photovoltaic_monitoring_system	carlosgavazzi eos-box photovoltaic monitoring system	eq	-