Lucene search

BoschCVE-2024-25002

HistoryMar 25, 2024 - 2:15 p.m.

CVE-2024-25002

2024-03-2514:15:09

CWE-78

bosch

web.nvd.nist.gov

cve-2024-25002

command injection

bosch network synchronizer

unauthorized access

diagnostics interface

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.6%

JSON

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device.

CNA Affected

[
  {
    "vendor": "Bosch",
    "product": "Network Synchronizer Enterprise",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.30"
      }
    ]
  },
  {
    "vendor": "Bosch",
    "product": "Network Synchronizer Standard",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.30"
      }
    ]
  }
]

References

psirt.bosch.com/security-advisories/BOSCH-SA-152190.html

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-25002