CVE-2021-23842
An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.14% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-321, CWE-798
- Affected
- bosch/amc2 firmware · bosch/access management system · bosch/access professional edition · bosch/building integration system
- Source
- psirt@bosch.com
References
- https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.htmlMitigation, Vendor Advisory
- https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.htmlMitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.