Unscored severity · published Dec 23, 2012
CVE-2012-6427
Carlo Gavazzi EOS Box SQL Injection
–
CVSS
1.3%
EPSS
No
On KEV
Description
The Carlo Gavazzi
EOS-Box
does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
EOS-Box · Carlo Gavazzi Automation
before 1.0.0.1080_2.1.10 · source: vendor
EP
Eos-box Photovoltaic Monitoring System · Carlosgavazzi
All versions, or not specified · source: NVD
EP
Eos-box Photovoltaic Monitoring System Firmware · Carlosgavazzi
through 1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6427
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02
US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-02.pdf
More from EOS-Box
–
CVE-2012-6428
Carlo Gavazzi EOS Box Hard-Coded Credentials