What’s Vulnerable › Vulnerabilities

CVE-2018-16669

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-09-18 · updated 2026-06-17
• Weakness: CWE-522

Description

An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife panels.

Affected products

• Circontrol Open Charge Point Protocol: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: Circontrol Open Charge Point Protocol 1.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
• https://www.exploit-db.com/exploits/45384/
• https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
• https://www.exploit-db.com/exploits/45384/

Get alerted when CVE-2018-16669 or the next vulnerability affects your stack