VulnerabilityModified

CVE-2012-6427

The Carlo Gavazzi EOS-Box does not check the validity of the data before executing queries.

HIGH 7.5EPSS 1.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The Carlo Gavazzi EOS-Box does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 1.33% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: carlosgavazzi/eos-box photovoltaic monitoring system firmware · carlosgavazzi/eos-box photovoltaic monitoring system
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02
http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-02.pdfUS Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.