Vendor
EFACEC
15 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
Medium 5.3
INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.
-
Medium 6.8
INFORMATION DISCLOSURE WITHIN THE OPERATING SYSTEM
The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.
-
Medium 6.9
WEEK ENCODING FOR PASSWORDS
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials
-
Medium 4.1
Improper Access Control in EFACEC UC 500E
A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in EFACEC UC 500E
An attacker could create malicious requests to obtain sensitive information about the web server.
-
Medium 4.3
URL Redirection to Untrusted Site ('Open Redirect') in EFACEC UC 500E
An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users.
-
Medium 6.3
Cleartext Transmission of Sensitive Information in EFACEC UC 500E
An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the application.