CVE-2021-23843
Description
The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password protection on configured devices to restrict access to the configuration of an AMC2. An attacker can circumvent this protection and make unauthorized changes to configuration data on the device. An attacker can exploit this vulnerability to manipulate the device\'s configuration or make it unresponsive in the local network. The attacker needs to have access to the local network, typically even the same subnet.
How to fix
- bosch building_integration_system4.9.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bosch amc2_firmware | No range specified | — |
| bosch access_management_system | 3.0 | — |
| bosch access_professional_edition | v ≤ 3.8.0 | — |
| bosch building_integration_system | v < 4.9.1 | 4.9.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.