PT-2022-9430 · Bosch · Accessipconfig.Exe+1

Alexander Nochvay · Published 2022-01-19 · Updated 2022-01-28 · CVE-2021-23843

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe (affected versions not specified)

Description The Bosch software tools are used to configure settings in AMC2 devices and allow password protection to restrict access. However, an attacker can circumvent this protection, making unauthorized changes to configuration data or manipulating the device's configuration, potentially making it unresponsive in the local network. The attacker must have access to the local network, typically the same subnet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-23843

Affected Products

Accessipconfig.Exe

Amcipconfig.Exe

References · 5

• https://osv.dev/vulnerability/CVE-2021-23843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23843 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html · Vendor Advisory
• https://t.me/cvenotify/25971 · Telegram Post
• https://t.me/cibsecurity/35901 · Telegram Post