PT-2018-13685 · Circontrol · Circontrol Open Charge Point Protocol

Publicado 2018-09-18 · Atualizado 2019-10-03 · CVE-2018-16669

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CIRCONTROL Open Charge Point Protocol (OCPP) versions prior to 1.5.0

Description An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) due to the storage of credentials in XML files. This allows an unprivileged user to access the admin credentials of the ocpp and circarlife panels by looking at the /services/config/config.xml file.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /services/config/config.xml file to prevent unauthorized users from obtaining the admin credentials.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-16669

Produtos afetados

Circontrol Open Charge Point Protocol

Referências · 4

• 🔥 https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life · Exploit
• 🔥 https://exploit-db.com/exploits/45384 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16669 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16669 · Aviso do Fabricante