Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Enel X JuiceBox 40 charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the telnet service, which listens on TCP port 2000 by default. The issue results from the lack of authentication prior to allowing remote connections. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23285.

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00079.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Enel X Subscribe
Juicebox 40 Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Enel X Subscribe
Juicebox 40 Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.zerodayinitiative.com/advisories/ZDI-26-041/ cve-icon cve-icon
History

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Enel X
Enel X juicebox 40
Vendors & Products Enel X
Enel X juicebox 40

Fri, 23 Jan 2026 04:00:00 +0000

Type Values Removed Values Added
Description Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Enel X JuiceBox 40 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the telnet service, which listens on TCP port 2000 by default. The issue results from the lack of authentication prior to allowing remote connections. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23285.
Title Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability
Weaknesses CWE-306
References
Metrics cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published:

Updated: 2026-01-23T19:15:17.480Z

Reserved: 2026-01-08T22:51:00.955Z

Link: CVE-2026-0778

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-01-23T04:16:05.073

Modified: 2026-01-23T04:16:05.073

Link: CVE-2026-0778

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-23T10:26:23Z

Weaknesses