CVE-2023-29122 - Vulnerability Details - OpenCVE

Under certain conditions, access to service libraries is granted to account they should not have access to.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00028.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Enel X	Juicebox Pro3.0 22kw Cellular

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-32725	Under certain conditions, access to service libraries is granted to account they should not have access to.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00024}`	epss `{'score': 0.00025}`

Tue, 05 Nov 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Enel X Enel X juicebox Pro3.0 22kw Cellular
CPEs		cpe:2.3:a:enel_x:juicebox_pro3.0_22kw_cellular::::::::
Vendors & Products		Enel X Enel X juicebox Pro3.0 22kw Cellular
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 05 Nov 2024 15:45:00 +0000

Type	Values Removed	Values Added
Description		Under certain conditions, access to service libraries is granted to account they should not have access to.
Title		Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
Weaknesses		CWE-708
References		https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
Metrics		cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ASRG

Published: 2024-11-05T15:24:43.416Z

Updated: 2024-11-05T18:58:24.529Z

Reserved: 2023-03-31T10:22:52.668Z

Link: CVE-2023-29122

Vulnrichment

Updated: 2024-11-05T18:58:18.979Z

NVD

Status : Awaiting Analysis

Published: 2024-11-05T16:15:16.577

Modified: 2024-11-06T18:17:17.287

Link: CVE-2023-29122

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29122", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "state": "PUBLISHED", "assignerShortName": "ASRG", "dateReserved": "2023-03-31T10:22:52.668Z", "datePublished": "2024-11-05T15:24:43.416Z", "dateUpdated": "2024-11-05T18:58:24.529Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Internal Service's Libraries"], "product": "JuiceBox Pro 3.0 22kW Cellular", "vendor": "Enel X", "versions": [{"lessThanOrEqual": "2.1.1.0_JB3VU096A", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Artem Ivachev (PCAutomotive)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Under certain conditions, access to service libraries is granted to account they should not have access to."}], "value": "Under certain conditions, access to service libraries is granted to account they should not have access to."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2024-11-05T15:24:43.416Z"}, "references": [{"url": "https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf"}], "source": {"discovery": "EXTERNAL"}, "title": "Incorrect file ownership of privileged service's libraries in Enel X JuiceBox", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "enel_x", "product": "juicebox_pro3.0_22kw_cellular", "cpes": ["cpe:2.3:a:enel_x:juicebox_pro3.0_22kw_cellular:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.1.0_JB3VU096A", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-05T18:57:41.194180Z", "id": "CVE-2023-29122", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T18:58:24.529Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-29122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-05T18:57:41.194180Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:enel_x:juicebox_pro3.0_22kw_cellular:*:*:*:*:*:*:*:*"], "vendor": "enel_x", "product": "juicebox_pro3.0_22kw_cellular", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.1.1.0_JB3VU096A"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T18:58:18.979Z"}}], "cna": {"title": "Incorrect file ownership of privileged service's libraries in Enel X JuiceBox", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Artem Ivachev (PCAutomotive)"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Enel X", "modules": ["Internal Service's Libraries"], "product": "JuiceBox Pro 3.0 22kW Cellular", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.1.1.0_JB3VU096A"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Under certain conditions, access to service libraries is granted to account they should not have access to.", "supportingMedia": [{"type": "text/html", "value": "Under certain conditions, access to service libraries is granted to account they should not have access to.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2024-11-05T15:24:43.416Z"}}}, "cveMetadata": {"cveId": "CVE-2023-29122", "state": "PUBLISHED", "dateUpdated": "2024-11-05T18:58:24.529Z", "dateReserved": "2023-03-31T10:22:52.668Z", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "datePublished": "2024-11-05T15:24:43.416Z", "assignerShortName": "ASRG"}, "dataVersion": "5.1"}