PT-2022-6306 · Bosch · Bosch B420

Published 2022-12-21 · Updated 2023-08-08 · CVE-2022-47648

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bosch B420 firmware 02.02.0001

Description The issue is related to improper access control in the Bosch B420 Ethernet module's control panel, allowing an attacker to bypass security restrictions and gain unauthorized access to protected information by sending specially crafted requests. This is due to the use of IP-based authorization in the authentication mechanism, which enables attackers to access the device if they are on the same network as a legitimate user. The B420 module is obsolete, with its End of Life announcement made in 2013.

Recommendations For Bosch B420 firmware 02.02.0001, consider restricting access to the control panel to minimize the risk of exploitation, as the device's IP-based authorization mechanism can be bypassed by attackers on the same network as a legitimate user. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Authentication

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-284

CWE-287

CWE-264

CWE-290

Related Identifiers

BDU:2023-00801

CVE-2022-47648

Affected Products

Bosch B420

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-47648 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00801 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47648 · Vendor Advisory
• https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing · Note
• https://t.me/cibsecurity/57814 · Telegram Post
• https://vuldb.com/ru/?id.220465 · Note
• https://t.me/cvenotify/44458 · Telegram Post
• https://pastebin.com/raw/0CGTpiEn · Note