CVE-2012-6428

The Carlo Gavazzi EOS-Box stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.

Score

CVSS 2.0 10.0 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2012-12-23

Last modified

2025-07-01

Weaknesses

CWE-255, CWE-798

Affected products

• Eos-box (Carlo Gavazzi Automation)
• Eos-box Photovoltaic Monitoring System (Carlosgavazzi)
• Eos-box Photovoltaic Monitoring System Firmware (Carlosgavazzi)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02
• http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-02.pdf