CVE-2012-6427
Carlo Gavazzi EOS Box SQL Injection
The Carlo Gavazzi EOS-Box
does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
Exploit likelihood
What each source reports
CVE List Score used
Carlo Gavazzi EOS Box SQL Injection
The Carlo Gavazzi EOS-Box
does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
- Record
CVE-2012-6427- CVSS 2.0
- 7.8
AV:N/AC:L/Au:N/C:C/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2012-6282
The Carlo Gavazzi EOS-Box
does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
- Record
EUVD-2012-6282- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:C/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7qc4-45cg-h6f3 No score
Multiple SQL injection vulnerabilities in Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2...
Multiple SQL injection vulnerabilities in Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, a similar issue to CVE-2012-5861.
- Record
GHSA-7qc4-45cg-h6f3- Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
The Carlo Gavazzi EOS-Box
does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
- Record
CVE-2012-6427- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:C/I:N/A:N - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-6427 is a vulnerability (CVSS 7.8) in Carlo Gavazzi Automation Eos-box, published December 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. No source names a fixed version.