CVE-2021-45878

CVE-2021-45878 affects GARO Wallbox GLB/GTB/GTC family. Root cause: lack of access control on web manager pages, enabling any user to view and modify information. Impact: potential unauthorized view/modify of data (high confidentiality and integrity impact per the CVE’s metadata; network vector, ...

CVE-2021-45877

CVE-2021-45877 affects multiple GARO Wallbox GLB/GTB/GTC versions; root cause is a hard-coded credential in /etc/tomcat8/tomcat-user.xml that allows attackers to gain authorized access and take full control of Tomcat on port 8000 (Tomcat manager page). The connected sources corroborate the impact...

CVE-2021-45877: Use of Hard-coded Credentials

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by hard coded credentials. A hardcoded credential exist in /etc/tomcat8/tomcat-user.xml, which allows attackers to gain authorized access and control the tomcat completely on port 8000 in the tomcat manger page...

CVE-2021-45878: Missing Authentication for Critical Function

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the web manger pages allows any user to view and modify information...

CVE-2021-45876: Improper Neutralization of Special Elements used in a Command

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware...