CVE-2021-23842
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.
Published:Jan 19, 2022
Last Modified:Nov 21, 2024
EPS:Jan 19, 2022
EPSS Score:0.00027
CVSS Score:5.7
Affected Products
Vendor
Product
Action
Vendor
Bosch
Product
Access Management System
Bosch
Access Management System
Vendor
Bosch
Product
Access Professional Edition
Bosch
Access Professional Edition
Vendor
Bosch
Product
Amc2
Bosch
Amc2
Vendor
Bosch
Product
Amc2 Firmware
Bosch
Amc2 Firmware
Vendor
Bosch
Product
Building Integration System
Bosch
Building Integration System
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
