{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2023-29114",
        "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
        "state": "PUBLISHED",
        "assignerShortName": "ASRG",
        "dateReserved": "2023-03-31T10:22:52.667Z",
        "datePublished": "2024-11-05T15:01:08.666Z",
        "dateUpdated": "2024-11-05T17:00:26.636Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Web Manager interface"
                    ],
                    "product": "JuiceBox Pro 3.0 22kW Cellular",
                    "vendor": "Enel X",
                    "versions": [
                        {
                            "lessThan": "2.1.1.0_JB3VU096A",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "user": "00000000-0000-4000-9000-000000000000",
                    "value": "Abdellah Benotsmane (PCAutomotive)"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "System logs could be accessed through web management application due to a lack of access control.<br>\n\n<div>An attacker can obtain the following sensitive information:</div><div>•     Wi-Fi access point credentials to which the EV charger can connect.</div><div>•     APN web address and credentials.</div><div>•     IPSEC credentials.</div><div>•     Web interface access credentials for user and admin accounts.</div><div>•     JuiceBox system components (software installed, model, firmware version, etc.).</div><div>•     C2G configuration details.</div><div>•     Internal IP addresses.</div><div>•     OTA firmware update configurations (DNS servers).</div><div>All the credentials are stored in logs in an unencrypted plaintext format.</div><br>"
                        }
                    ],
                    "value": "System logs could be accessed through web management application due to a lack of access control.\n\n\nAn attacker can obtain the following sensitive information:\n\n•     Wi-Fi access point credentials to which the EV charger can connect.\n\n•     APN web address and credentials.\n\n•     IPSEC credentials.\n\n•     Web interface access credentials for user and admin accounts.\n\n•     JuiceBox system components (software installed, model, firmware version, etc.).\n\n•     C2G configuration details.\n\n•     Internal IP addresses.\n\n•     OTA firmware update configurations (DNS servers).\n\nAll the credentials are stored in logs in an unencrypted plaintext format."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-37",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "ADJACENT_NETWORK",
                        "availabilityImpact": "NONE",
                        "baseScore": 5.7,
                        "baseSeverity": "MEDIUM",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "LOW",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-200",
                            "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
                "shortName": "ASRG",
                "dateUpdated": "2024-11-05T15:01:08.666Z"
            },
            "references": [
                {
                    "url": "https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf"
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            },
            "title": "Unauthorized System Log Disclosure in Enel X JuiceBox",
            "x_generator": {
                "engine": "Vulnogram 0.1.0-dev"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2024-11-05T17:00:16.930334Z",
                                "id": "CVE-2023-29114",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-11-05T17:00:26.636Z"
                }
            }
        ]
    }
}