High · published January 23, 2026
🚨 A telnet service with wide-open doors is a dream come true for attackers! The Enel X JuiceBox 40 charging stations allow remote code execution without any authentication needed. 🔥 Think of it as a gas station that forgot to lock the pumps at night. Anyone can roll up, fill their tank with whatever they want, and even drain the entire fuel supply without anyone batting an eye! This vulnerability allows a network-adjacent attacker to execute arbitrary code on the charging station, potentially leading to severe consequences. Imagine a malicious actor taking control of the device, altering its operations, or even causing a broader disruption to the network it's connected to. It’s absolutely devastating!
Think of it as a gas station that forgot to lock the pumps at night. Anyone can roll up, fill their tank with whatever they want, and even drain the entire fuel supply without anyone batting an eye! The flaw lies in the telnet service on TCP port 2000, which lacks authentication checks for remote connections. This means that any attacker on the same network can connect and execute code as if they were the legitimate service account, opening up a realm of possibilities for exploitation.
This vulnerability allows a network-adjacent attacker to execute arbitrary code on the charging station, potentially leading to severe consequences. Imagine a malicious actor taking control of the device, altering its operations, or even causing a broader disruption to the network it's connected to. It’s absolutely devastating! To protect your JuiceBox 40 installations, immediately disable the telnet service if not in use, or ensure it's not exposed to untrusted networks. Additionally, consider updating to the latest firmware that addresses this vulnerability, and monitor your network for any suspicious activity. 🛡️ You've got this! Take these steps and you'll help keep your charging stations safe and sound. ⚡