{"id":"CVE-2012-6428","aliases":["EUVD-2012-6283","GHSA-mp78-772x-4r85"],"status":"published","title":"Carlo Gavazzi EOS Box Hard-Coded Credentials","description":"The Carlo Gavazzi \nEOS-Box\n\nstores hard-coded passwords in the PHP file of \nthe device. By using the hard-coded passwords, attackers can log into \nthe device with administrative privileges. This could allow the attacker\n to have unauthorized access.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01533,"percentile":0.74978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-255","CWE-798"],"published":"2012-12-23T21:00:00Z","modified":"2026-06-16T23:48:05Z","products":[{"vendor":"carlo gavazzi automation","product":"eos-box"},{"vendor":"carlosgavazzi","product":"eos-box_photovoltaic_monitoring_system"},{"vendor":"carlosgavazzi","product":"eos-box_photovoltaic_monitoring_system_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02"},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-02.pdf","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6428"},{"url":"https://github.com/advisories/GHSA-mp78-772x-4r85"}],"sources":{"cve":[{"id":"CVE-2012-6428","title":"Carlo Gavazzi EOS Box Hard-Coded Credentials","description":"The Carlo Gavazzi \nEOS-Box\n\nstores hard-coded passwords in the PHP file of \nthe device. By using the hard-coded passwords, attackers can log into \nthe device with administrative privileges. This could allow the attacker\n to have unauthorized access.","status":"published","published":"2012-12-23T21:00:00Z","modified":"2025-07-01T19:59:06.114Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","assessor":"cna"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:34:50.94153Z"}],"euvd":[{"id":"EUVD-2012-6283","description":"The Carlo Gavazzi \nEOS-Box\n\nstores hard-coded passwords in the PHP file of \nthe device. By using the hard-coded passwords, attackers can log into \nthe device with administrative privileges. This could allow the attacker\n to have unauthorized access.","status":"published","published":"2012-12-23T21:00:00Z","modified":"2025-07-01T19:59:06Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"critical"}],"updated_at":"2026-11-02T20:32:14.813568Z"}],"ghsa":[{"id":"GHSA-mp78-772x-4r85","title":"Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 establishes multiple hardcoded...","description":"Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 establishes multiple hardcoded accounts, which makes it easier for remote attackers to obtain administrative access by reading a password in a PHP script, a similar issue to CVE-2012-5862.","status":"published","published":"2022-05-17T05:17:03Z","modified":"2025-07-01T21:32:13Z","cwes":["CWE-798"],"updated_at":"2026-11-02T15:02:52.793128Z"}],"nvd":[{"id":"CVE-2012-6428","description":"The Carlo Gavazzi \nEOS-Box\n\nstores hard-coded passwords in the PHP file of \nthe device. By using the hard-coded passwords, attackers can log into \nthe device with administrative privileges. This could allow the attacker\n to have unauthorized access.","status":"published","published":"2012-12-23T21:55:01.653Z","modified":"2026-06-16T23:48:05.08Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-798","CWE-255"],"updated_at":"2026-11-02T14:02:16.958223Z"}]}}