PT-2024-1495 · Bosch · Nexo-Os

Andrea Palanca · Published 2024-01-08 · Updated 2024-01-17 · CVE-2023-48250

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NEXO-OS (affected versions not specified)

Description The issue allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts. This can enable the attacker to gain unauthorized access to protected information. The vulnerability is related to the use of hard-coded credentials in the NEXO-OS operating system for Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2024-01003

CVE-2023-48250

Affected Products

Nexo-Os

References · 7

• https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01003 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48250 · Security Note
• https://t.me/cvenotify/67772 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745077230999404998 · Twitter Post
• https://twitter.com/CVEnew/status/1745035890043338767 · Twitter Post