« Volver al listado

CVE-2021-23842

Estado: ModificadaAlta (7.1)—

Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Bosch — Access Management SystemBosch — Access Professional EditionBosch — Amc2 FirmwareBosch — Building Integration System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-23842",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@bosch.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@bosch.com",
      "affectedData": [
        {
          "vendor": "Bosch",
          "product": "AMS",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Bosch",
          "product": "APE",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "3.8.x"
            }
          ]
        },
        {
          "vendor": "Bosch",
          "product": "BIS",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "4.9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Bosch",
          "product": "AMC2",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-19T21:15:08.137",
  "references": [
    {
      "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "psirt@bosch.com"
    },
    {
      "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@bosch.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet."
    },
    {
      "lang": "es",
      "value": "La comunicación con el AMC2 usa un algoritmo criptográfico de última generación para el cifrado simétrico llamado Blowfish. Un atacante podría recuperar la clave del firmware para descifrar el tráfico de red entre el AMC2 y el sistema anfitrión. Así, un atacante puede explotar esta vulnerabilidad para descifrar y modificar el tráfico de red, descifrar e investigar el archivo de firmware del dispositivo y cambiar la configuración del mismo. El atacante necesita tener acceso a la red local, normalmente incluso a la misma subred"
    }
  ],
  "lastModified": "2026-06-17T03:38:54.993",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bosch:amc2_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3032BCA-136A-470F-BD1D-A05FC5D22782"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bosch:amc2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B51541D3-C8B6-4C5E-AC77-70A3F3D7D315"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bosch:access_management_system:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C98BA3F6-853A-42EA-B7B9-7163AE2A7E74"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bosch:access_professional_edition:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28B735B8-BBBB-43BD-A06C-3297E44DA485",
              "versionEndIncluding": "3.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bosch:building_integration_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95FDA5B3-E4CB-4285-B3E3-C54F3394E9B2",
              "versionEndExcluding": "4.9.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@bosch.com"
}