PT-2022-3526 · Bosch · Bosch Ethernet Switch Pra-Es8P2S

Published 2022-06-07 · Updated 2022-07-01 · CVE-2022-32535

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bosch Ethernet switch PRA-ES8P2S version 1.01.05

Description The issue is related to insufficient access control in the software of the Bosch Ethernet switch PRA-ES8P2S. This could allow a remote attacker to bypass existing security restrictions and gain elevated privileges, potentially up to root level. The web server of the switch runs with root privilege, which could be exploited to gain root access.

Recommendations For version 1.01.05, consider restricting access to the web server or disabling it until a patch is available to prevent potential exploitation. Additionally, review and implement strict access controls to minimize the risk of privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-250

Related Identifiers

BDU:2022-04309

CVE-2022-32535

Affected Products

Bosch Ethernet Switch Pra-Es8P2S

References · 6

• https://osv.dev/vulnerability/CVE-2022-32535 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32535 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04309 · Security Note
• https://cybersecurity-help.cz/vdb/SB2022062718 · Note
• https://vuldb.com/?id.202519 · Note