CVE-2021-23846

B426 Credential Disclosure

CVSS 8.8 HIGHEPSS 0.5%CWE-319

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.5%KEV nãoPoC —Patch —

Lifecycle

Jun 18, 2021Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM attack. This will be fixed starting from Firmware version 3.11.5, which will be released on the 30th of June, 2021.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Bosch · B426 Firmware

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html