PT-2022-9429 · Amc2 · Amc2

Alexander Nochvay · Published 2022-01-19 · Updated 2022-01-28 · CVE-2021-23842

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions AMC2 (affected versions not specified)

Description The issue concerns the use of the Blowfish symmetric encryption algorithm in communication between the AMC2 and the host system. An attacker with access to the local network, typically on the same subnet, could retrieve the key from the firmware to decrypt network traffic. This allows the attacker to modify network traffic, decrypt and investigate the device's firmware file, and change the device configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2021-23842

Affected Products

Amc2

References · 4

• https://osv.dev/vulnerability/CVE-2021-23842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23842 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html · Vendor Advisory
• https://t.me/cibsecurity/35899 · Telegram Post