Vulnerability · Published Jun 18, 2021 · Assigned by bosch
CVE-2021-23846B426 Credential Disclosure
High 8.8
In plain English
A high-severity security flaw in B426 Firmware from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 59.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM attack. This will be fixed starting from Firmware version 3.11.5, which will be released on the 30th of June, 2021.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch | B426 Firmware | 03.01.000403.02.00203.05.000303.03.0009 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html x_refsource_CONFIRM