CVE-2021-23842
Medium
Description
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.
SeverityMedium
CVSS5.7
Exploit probability—
ProductBosch Amc2 Firmware
PublishedJan 19, 2022
First seenJan 19, 2022
Weakness typeCWE-321CWE-321
How to fix
Update
- bosch building_integration_system4.9.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bosch amc2_firmware | No range specified | — |
| bosch access_management_system | 3.0 | — |
| bosch access_professional_edition | v ≤ 3.8.0 | — |
| bosch building_integration_system | v < 4.9.1 | 4.9.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.