CVE-2018-16670

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

Design/Logic Flaw

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository...

CVE-2018-16668

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository...

Open redirect

An issue was discovered in CIRCONTROL Open Charge Point Protocol OCPP before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife...

CVE-2018-16668

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository...

Information disclosure

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id...

Design/Logic Flaw

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

CVE-2018-16669

An issue was discovered in CIRCONTROL Open Charge Point Protocol OCPP before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife...

CVE-2018-16668

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository...

CVE-2018-16669

The CVE-2018-16669 entry concerns CIRCONTROL’s Open Charge Point Protocol (OCPP) implementations used in CirCarLife, PowerStudio, and similar products. The issue arises from storing admin credentials in XML files, allowing an unprivileged user to read /services/config/config.xml and obtain OCPP/c...

CVE-2018-16670

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

CVE-2018-16671

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id...

CVE-2018-16671

CirCarLife before 4.3 is affected by CVE-2018-16671 due to improper authentication for /html/device-id, causing system software information disclosure. Affected component is the CirCarLife web interface; root cause is lack of authentication on the device-id endpoint, enabling an unauthenticated u...

CVE-2018-16670

CVE-2018-16670 affects CIRCONTROL CirCarLife prior to 4.3. The issue is improper authentication that allows disclosure of PLC status information via the unauthenticated access to /html/devstat.html. Reported details indicate an attacker can obtain sensitive PLC status data and, per some sources, ...

CVE-2018-16668

CVE-2018-16668 affects CirControl CirCarLife before 4.3. The issue is improper authentication that allows an internal installation path disclosure via /html/repository, potentially enabling attackers to obtain sensitive information and perform unauthorized operations. Nuclei/Nuclei-style template...

CirCarLife SCADA 4.3.0 - Credential Disclosure Exploit

Exploit for hardware platform in category web applications Exploit Title: CirCarLife SCADA 4.3.0 - Credential Disclosure Exploit Author: David Castro Vendor Homepage: https://circontrol.com/ Shodan Dork: Server: CirCarLife Server: PsiOcppApp Version: CirCarLife Scada all versions under 4.3.0 OCPP...

CirCarLife SCADA 4.3.0 - Credential Disclosure

CirCarLife SCADA 4.3.0 - Credential Disclosure Exploit Title: CirCarLife SCADA 4.3.0 - Credential Disclosure Date: 2018-09-10 Exploit Author: David Castro Vendor Homepage: https://circontrol.com/ Shodan Dork: Server: CirCarLife Server: PsiOcppApp Version: CirCarLife Scada all versions under 4.3.0...

CirCarLife Scada Information Disclosure Vulnerability

Circontrol CirCarLife Scada is a parking lot automation system from Circontrol, Spain. A security vulnerability exists in Circontrol CirCarLife Scada version 4.2.4. A remote attacker can exploit this vulnerability by sending a direct request to the html/log or services/system/info.html URIs to...

CirCarLife Scada Unauthorized Upgrade Vulnerability

Circontrol CirCarLife Scada is a parking lot automation system from Circontrol, Spain. A security vulnerability exists in Circontrol CirCarLife Scada version 4.2.4. The vulnerability can be exploited to disclose sensitive information by sending requests to the html/upgrade.html and...