PT-2023-22218 · Bosch · Bosch Building Integration System

Published 2023-06-30 · Updated 2023-07-12 · CVE-2023-29241

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bosch Building Integration System (BIS) version 5.0

Description The issue is related to improper information in the cybersecurity guidebook of the Bosch Building Integration System, which may lead to incorrect configuration. This incorrect configuration allows local users to access data via the network.

Recommendations For Bosch Building Integration System (BIS) version 5.0, ensure that the cybersecurity guidebook is properly followed and the configuration is corrected to prevent local users from accessing data via the network. As a temporary workaround, consider restricting network access to authorized personnel only until the configuration issue is resolved.

Fix

Weakness Enumeration

CWE-1112

Related Identifiers

CVE-2023-29241

Affected Products

Bosch Building Integration System

References · 4

• https://osv.dev/vulnerability/CVE-2023-29241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29241 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-988400-BT.html · Vendor Advisory
• https://t.me/cvenotify/53478 · Telegram Post