PT-2024-13561 · Rexroth+1 · Nexo Cordless Nutrunner Nxa011S-36V+8

Andrea Palanca · Published 2024-01-10 · Updated 2024-01-17 · CVE-2023-48253

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. This can be exploited to exfiltrate other users’ password hashes or update them with arbitrary values, allowing access to their accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-48253

Affected Products

Nexo Cordless Nutrunner Nxa011S-36V

Nexo Cordless Nutrunner Nxa015S-36V

Nexo Cordless Nutrunner Nxa030S-36V

Nexo Cordless Nutrunner Nxa050S-36V

Nexo Cordless Nutrunner Nxa065S-36V

Nexo Cordless Nutrunner Nxp012Qd-36V

Nexo Cordless Nutrunner Nxp012Qd-36V-B

Bosch Nexo Special Cordless Nutrunner

Nexo-Os

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-48253 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48253 · Vendor Advisory
• https://t.me/cvenotify/67776 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745110379573788823 · Twitter Post
• https://t.me/cvenotify/66898 · Telegram Post
• https://twitter.com/CVEnew/status/1745077428270006303 · Twitter Post