• 1 (current)
  • 2
  • 3
November 2023
Titel
Multiple vulnerabilities on ctrlX HMI / WR21
Veröffentlicht
21. November 2023 01:00
Text

BOSCH-SA-175607: The operating system of the ctrlX HMI/ WR21 before build date 20231107 has some vulnerabilities when the kiosk mode is used in conjunction with Google Chrome. Therefore, it is possible in worst case that an attacker with physical access to the device can get root access without normal authentication ...

Oktober 2023
Titel
Multiple vulnerabilities on ctrlX HMI Web Panel - WR21
Veröffentlicht
25. Oktober 2023 02:00
Text

BOSCH-SA-175607: The operating system of the ctrlX WR21 HMI has several vulnerabilities when the Kiosk mode is used in conjunction with Google Chrome. In worst case, an attacker with physical access to the device might gain full root access without prior authentication by combining the exploitation of those vulnerabilities.Furthermore, the ...

Titel
Vulnerability in SICK Flexi Soft Gateway
Veröffentlicht
24. Oktober 2023 02:00
Text

BOSCH-SA-164691: The SLC-0-GPNT00300 from Bosch Rexroth contains technology from SICK AG. The manufacturer has published a security bulletin \[1\] regarding an authentication bypass by capture-replay. Exploiting the vulnerability would allow an unauthenticated attacker to login to the gateways by sending specially crafted packets and potentially impact the availability, integrity and ...

Titel
Multiple vulnerabilities in ctrlX WR21 HMI
Veröffentlicht
20. Oktober 2023 02:00
Text

BOSCH-SA-175607: The operating system of the ctrlX WR21 HMI has several vulnerabilities when the Kiosk mode is used in conjunction with Google Chrome. In worst case, an attacker with physical access to the device might gain full root access without prior authentication by combining the exploitation of those vulnerabilities.

August 2023
Titel
Remote Code Execution in RTS VLink Virtual Matrix
Veröffentlicht
30. August 2023 02:00
Text

BOSCH-SA-893251-BT: A security vulnerability has been uncovered in the admin interface of the RTS VLink Virtual Matrix Software. The vulnerability will allow a Remote Code Execution (RCE) attack.Versions v5 (\< 5.7.6) and v6 (\< 6.5.0) of the RTS VLink Virtual Matrix Software are affected by this vulnerability. Older versions are ...

Juli 2023
Titel
Security Advisory for the FL MGUARD family of devices
Veröffentlicht
4. Juli 2023 02:00
Text

BOSCH-SA-833074: The FL MGUARD family devices sold by Bosch Rexroth are devices from Phoenix Contact that have been introduced as trade goods. A security advisory has been published by the manufacturer, which indicates that the devices are affected by two vulnerabilities regarding RSA decryption and MAC filtering. \[1\] Parts No. ...

Titel
Vulnerability in the interface module SLC-0-GPNT00300
Veröffentlicht
4. Juli 2023 02:00
Text

BOSCH-SA-894143: The SLC-0-GPNT00300 from Bosch Rexroth contains technology from SICK AG. The manufacturer has published a security bulletin \[1\] regarding the missing authentication for a critical function. Exploiting the vulnerability would allow an unauthenticated attacker to change the IP address of the device and affect the availability of the module.

Juni 2023
Titel
Update in Cybersecurity Guidebook of BIS on Permission Settings for Network Share
Veröffentlicht
29. Juni 2023 02:00
Text

BOSCH-SA-988400-BT: In a recent survey of BIS installations worldwide Bosch identified that for some installations the security settings may not meet our recommended security standards. For this reason, we have updated our \"Cybersecurity Guidebook\".Section 4.5 of the Cybersecurity Guidebook describes how to configure access permissions for a shared folder of ...

Titel
Information Disclosure Vulnerability in Bosch IP cameras
Veröffentlicht
28. Juni 2023 02:00
Text

BOSCH-SA-839739-BT: An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information about the device itself (like capabilities) and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet.This vulnerability was discovered by Souvik Kandar ...

Mai 2023
Titel
Possible damage of secure element in Bosch IP cameras
Veröffentlicht
31. Mai 2023 02:00
Text

BOSCH-SA-435698-BT: Due to an error in the software interface to the secure element chip on the cameras, the chip can be **permanently damaged** leading to an unusable camera when enabling the Stream security option (signing of the video stream) on Bosch CPP13 and CPP14 cameras. The default setting for this ...

Titel
Unrestricted SSH port forwarding in BVMS
Veröffentlicht
24. Mai 2023 02:00
Text

BOSCH-SA-025794-BT: The Bosch Video Management System is using SSH server that does not restrict a port forwarding requested by an authenticated SSH client. An authenticated SSH client can request a connection which is forwarded by the BVMS SSH server to a resource within the trusted internal network, which is normally ...

Titel
.NET Remote Code Execution Vulnerability in BVMS, BIS and AMS
Veröffentlicht
24. Mai 2023 02:00
Text

BOSCH-SA-110112-BT: The Bosch Video Management System (BVMS), the Bosch Access Management System (AMS), and the Bosch Building Integration System (BIS) are using a vulnerable version of the Microsoft .NET package System.Text.Encodings.Web. The System.Text.Encodings.Web is a NuGet package from Microsoft, and Microsoft has published an advisory to provide information about a ...

Titel
Vulnerability in Wiegand card data interpretation
Veröffentlicht
24. Mai 2023 02:00
Text

BOSCH-SA-391095-BT: Bosch Access Control products AMC2-4WCF and AMC2-2WCF have a firmware bug which may lead to misinterpretation of access card data that is sent from a Wiegand reader. This may in turn lead to granting physical access to an unauthorized person. This vulnerability affects only products with Wiegand interface, i.e., ...

April 2023
Titel
Use of Telnet in the interface module SLC-0-GPNT00300
Veröffentlicht
28. April 2023 02:00
Text

BOSCH-SA-387640: The SLC-0-GPNT00300 from Bosch Rexroth contains technology from SICK AG. The manufacturer has published a security bulletin \[1\] regarding the availability of a Telnet interface for debugging.The SLC-0-GPNT00300 provides a Telnet interface for debugging, which is enabled by factory default.\No password is set in the default configuration.\If the password ...

Titel
Insecure authentication in B420 legacy communication module
Veröffentlicht
26. April 2023 02:00
Text

BOSCH-SA-341298-BT: An authentication vulnerability was found in the B420 Ethernet communication module from Bosch Security Systems. This is a legacy product which is currently obsolete and was announced to reach End on Life (EoL) on 2013. The B420 was last sold in July 2013 and was replaced by the B426. ...

Dezember 2022
Titel
Multiple Vulnerabilities in NetApp DSA E2800 series
Veröffentlicht
7. Dezember 2022 01:00
Text

BOSCH-SA-609377-BT: The Bosch DSA E2800 products are based on NetApp technology, which incorporates a Linux Kernel and other components such as the Oracle Java Platform Standard Edition (Java SE), OpenSSL, SANtricity OS Controller Software, E-Series SANtricity OS Controller Software, Docker, Eclipse Jetty, GNU C Library (aka glibc), Libnss, Zlib. These ...

Oktober 2022
Titel
Multiple Cross Site Scripting vulnerabilities in Bosch VIDEOJET multi 4000
Veröffentlicht
19. Oktober 2022 02:00
Text

BOSCH-SA-454166-BT: The possibility for a reflected Cross Site Scripting (XSS) and stored Cross Site Scripting (XSS) attack was discovered in the Bosch VIDEOJET multi 4000.For more details please see the description of the vulnerability in this advisory.Bosch rates this vulnerability with CVSSv3.1 base score 5.8 (medium) and 5.1 (medium), where ...

Titel
CVE-2021-3772 Linux Kernel Vulnerability in NetApp DSA E2800 series
Veröffentlicht
19. Oktober 2022 02:00
Text

BOSCH-SA-609377-BT: The Bosch DSA E2800 products are based on NetApp technology, which incorporate a Linux Kernel. Linux Kernel versions prior to 5.15.0 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or Denial of Service (DoS). Successful exploitation of this vulnerability could ...

September 2022
Titel
Information Disclosure in VIDEOJET Decoder and Operator Client application in BVMS
Veröffentlicht
21. September 2022 02:00
Text

BOSCH-SA-464066-BT: BVMS Operator Client application or the VIDEOJET Decoder VJD-7513 may receive an *unencrypted* live-stream from a camera which allows a man-in-the-middle attacker to compromise the confidential video streams.This happens only in combination with cameras of platform CPP13 or CPP14.x when encrypted UDP connection is configured. Please be aware that ...

August 2022
Titel
SafeLogic Designer vulnerabilities
Veröffentlicht
11. August 2022 02:00
Text

BOSCH-SA-463993: The SafeLogic Designer from Bosch Rexroth contains technology from SICK AG. The manufacturer has published a security bulletin regarding a vulnerability in the .NET framework. \[1\]A vulnerability in a .NET framework class used by SafeLogic Designer allows an attacker to craft malicious project files. Opening/importing such a malicious project ...

Titel
Multiple Vulnerabilities in BF-OS
Veröffentlicht
1. August 2022 02:00
Text

BOSCH-SA-013924-BT: Multiple vulnerabilities were identified in BF-OS version 3.x up to and including 3.83 used by Bigfish V3 and PR21 (Energy Platform) devices and Bigfish VM image, which are part of the data collection infrastructure of the Energy Platform solution.The most critical vulnerability may allow an unauthenticated remote attacker to ...

Juni 2022
Titel
Multiple Vulnerabilities PRA-ES8P2S Ethernet-Switch
Veröffentlicht
22. Juni 2022 02:00
Text

BOSCH-SA-247052-BT: Multiple vulnerabilities were found in the PRA-ES8P2S Ethernet-Switch including an Improper Input Validation, an Improper Privilege Management and an Execution with Unnecessary Privileges vulnerability.These vulnerabilities can give root access and/or administrator privilege to the switch from the network.Customers are advised to upgrade to version 1.01.07 that solves vulnerabilities CVE-2022-32534, ...

Mai 2022
Titel
Vulnerabilities in the communication protocol of the PLC runtime
Veröffentlicht
2. Mai 2022 02:00
Text

BOSCH-SA-577411: The PLC application of the control systems ctrlX CORE, IndraLogic, IndraMotion MTX, IndraMotion MLC and IndraMotion MLD contains PLC technology from CODESYS GmbH. The manufacturer CODESYS GmbH published multiple security bulletins \[1\], \[2\], \[3\], \[4\], \[5\]. By exploiting the vulnerabilities in the protocol for the communication between the PLC ...

April 2022
Titel
Vulnerability in routers FL MGUARD and TC MGUARD
Veröffentlicht
27. April 2022 02:00
Text

BOSCH-SA-982696: The FL MGUARD and TC MGUARD safety devices sold by Bosch Rexroth are devices from Phoenix Contact that have been introduced as trade goods. A security advisory has been published by the manufacturer, which indicates that devices are affected by a possible infinite loop within an OpenSSL library method ...

Titel
Improper Control of Generation of Code in Bosch MATRIX
Veröffentlicht
27. April 2022 02:00
Text

BOSCH-SA-309239-BT: The access control and time attendance management software Bosch MATRIX uses a version of the Java Spring Framework that is vulnerable to \"spring4shell\" (CVE-2022-22965). Bosch MATRIX does NOT use a configuration that is currently known to be exploitable using this vulnerability, but as the developers of Spring point out, ...

  • 1 (current)
  • 2
  • 3

Letzte Updates

BOSCH PSIRT
21.11.2023
CODESYS
28.06.2023
SIEMENS CERT
14.11.2023
US CERT
06.12.2023
US CERT (ICS)
07.12.2023

Nach Quelle

Archiv

2023
2022
2021
2020
2019
2018
2017

Feeds