CVE-2021-23845
High
Description
This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from version 3.08 on, which was released on June 2019.
SeverityHigh
CVSS8.0
Exploit probability—
ProductBosch B426 Firmware
PublishedJun 18, 2021
First seenJun 18, 2021
Weakness typeCWE-284Improper access control
How to fix
Update
- bosch b426_firmware03.08 or later
- bosch b426-cn_firmware03.08 or later
- bosch b429-cn_firmware03.08 or later
- bosch b426-m_firmware03.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bosch b426_firmware | v < 03.08 | 03.08 |
| bosch b426-cn_firmware | v < 03.08 | 03.08 |
| bosch b429-cn_firmware | v < 03.08 | 03.08 |
| bosch b426-m_firmware | v < 03.10 | 03.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.