Vulnerability · Published Jul 30, 2026 · Assigned by bosch

CVE-2026-56428

High 8.1

In plain English

A high-severity security flaw in BSH ELP (Electronic Platform) Modules from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance.

Affected products (as reported)

Vendor	Product	Versions
Bosch	BSH ELP (Electronic Platform) Modules	65.0.0 – before 65.2.12

Weakness: CWE-286 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-943700.html vendor-advisory