Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Enel X JuiceBox 40 charging stations. This issue arises from the telnet service, which listens on TCP port 2000 by default, and lacks authentication for remote connections. As a result, network-adjacent attackers can execute arbitrary code on the affected installations, using the service account's privileges.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected charging stations, with the executed code running in the context of the service account.

Remediation

The recommended mitigation strategy is to restrict interaction with the affected product.