CVE-2012-6428
Carlo Gavazzi EOS Box Hard-Coded Credentials
CVE-2012-6428 is a vulnerability (CVSS 10.0) in Carlo Gavazzi Automation Eos-box, published December 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. No source names a fixed version.
The Carlo Gavazzi EOS-Box
stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.
Exploit likelihood
What each source reports
CVE List Score used
Carlo Gavazzi EOS Box Hard-Coded Credentials
The Carlo Gavazzi EOS-Box
stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.
- Record
CVE-2012-6428- CVSS 2.0
- 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-798
- Updated
- 2026-11-02
EUVDEUVD-2012-6283
The Carlo Gavazzi EOS-Box
stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.
- Record
EUVD-2012-6283- CVSS 2.0
- 10.0 Critical
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mp78-772x-4r85 No score
Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 establishes multiple hardcoded...
Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 establishes multiple hardcoded accounts, which makes it easier for remote attackers to obtain administrative access by reading a password in a PHP script, a similar issue to CVE-2012-5862.
- Record
GHSA-mp78-772x-4r85- Weakness
- CWE-798
- Updated
- 2026-11-02
NVD
The Carlo Gavazzi EOS-Box
stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.
- Record
CVE-2012-6428- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-798, CWE-255
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |