Vulnerability · Published Nov 5, 2024 · Assigned by ASRG
CVE-2023-29117Authentication Bypass in JuiceBox Web Manager interface
High 8.8
In plain English
A high-severity improper authentication in JuiceBox Pro 3.0 22kW Cellular from Enel X. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 74.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Enel X | JuiceBox Pro 3.0 22kW Cellular | 0 – through 2.1.1.0_JB3VU096A |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H