PT-2024-20692 · Bosch · Bosch Network Synchronizer

Published 2024-03-25 · Updated 2024-03-26 · CVE-2024-25002

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bosch Network Synchronizer (affected versions not specified)

Description Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-25002

Affected Products

Bosch Network Synchronizer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-25002 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-152190.html · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1772302576299442686 · Twitter Post
• https://t.me/cvenotify/74584 · Telegram Post
• https://twitter.com/cracbot/status/1772709573033426948 · Twitter Post
• https://t.me/cvenotify/74591 · Telegram Post
• https://twitter.com/vuldb/status/1772590832702693727 · Twitter Post
• https://twitter.com/CVEnew/status/1772265767402152365 · Twitter Post