彙總 circontrol 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 路徑處理缺陷與緩衝區溢位 等問題，部分漏洞可能導致 檔案覆寫，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2020-8006 | The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The ocpp1.5 and pwrstudio binaries on the charging station do not use a number of common exploitation mitigations. In particular, there are no stack canaries and they do not use the Position Independent Executable (PIE) format. | [email protected] | 8.8 | 1.11% | 2024-04-12 | 2026-06-16 |
| CVE-2018-17922 | Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication. | [email protected] | 9.8 | 3.25% | 2018-11-02 | 2026-06-16 |
| CVE-2018-17918 | Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page. | [email protected] | 9.8 | 3.81% | 2018-11-02 | 2026-06-16 |
| CVE-2018-16672 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system/setup.json, an authenticated but unprivileged user can exfiltrate critical setup information. | [email protected] | 6.5 | 1.72% | 2018-09-26 | 2026-06-16 |
| CVE-2018-16671 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id. | [email protected] | 5.3 | 8.92% | 2018-09-18 | 2026-06-16 |
| CVE-2018-16670 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html. | [email protected] | 5.3 | 24.57% | 2018-09-18 | 2026-06-16 |
| CVE-2018-16669 | An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife panels. | [email protected] | 9.8 | 2.14% | 2018-09-18 | 2026-06-16 |
| CVE-2018-16668 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository. | [email protected] | 5.3 | 9.51% | 2018-09-18 | 2026-06-16 |
| CVE-2018-12635 | CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs. | [email protected] | 7.5 | 0.89% | 2018-06-21 | 2026-06-16 |
| CVE-2018-12634 | CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI. | [email protected] | 9.8 | 56.83% | 2018-06-21 | 2026-06-16 |