CVE-2023-48250

The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:bosch:nexo-os:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\):-:::::::*
	cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\):-:::::::*
	cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2272\):-:::::::*
	cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2301\):-:::::::*
	cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2514\):-:::::::*
	cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2515\):-:::::::*
	cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2666\):-:::::::*
	cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2673\):-:::::::*

History

17 Jan 2024, 20:31

Type	Values Removed	Values Added
CPE		cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2272\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\):-:::::::* cpe:2.3:o:bosch:nexo-os:::::::: cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\):-:::::::* cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2666\):-:::::::* cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2301\):-:::::::* cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2515\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\):-:::::::* cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2514\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\):-:::::::* cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\):-:::::::* cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2673\):-:::::::*
Summary		(es) La vulnerabilidad permite a un atacante remoto autenticarse en la aplicación web con altos privilegios a través de múltiples cuentas ocultas codificadas.
References	~~() https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html -~~	() https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html - Vendor Advisory
First Time		Bosch nexo Cordless Nutrunner Nxv012t-36v-b \(0608842016\) Bosch nexo Special Cordless Nutrunner \(0608pe2666\) Bosch nexo Cordless Nutrunner Nxv012t-36v \(0608842015\) Bosch nexo Cordless Nutrunner Nxa050s-36v \(0608842003\) Bosch nexo Cordless Nutrunner Nxa030s-36v \(0608842002\) Bosch Bosch nexo Cordless Nutrunner Nxa030s-36v-b \(0608842007\) Bosch nexo Cordless Nutrunner Nxp012qd-36v \(0608842005\) Bosch nexo-os Bosch nexo Special Cordless Nutrunner \(0608pe2515\) Bosch nexo Cordless Nutrunner Nxa011s-36v-b \(0608842012\) Bosch nexo Special Cordless Nutrunner \(0608pe2673\) Bosch nexo Cordless Nutrunner Nxa015s-36v-b \(0608842006\) Bosch nexo Cordless Nutrunner Nxa050s-36v-b \(0608842008\) Bosch nexo Cordless Nutrunner Nxa065s-36v-b \(0608842014\) Bosch nexo Cordless Nutrunner Nxa015s-36v \(0608842001\) Bosch nexo Special Cordless Nutrunner \(0608pe2272\) Bosch nexo Special Cordless Nutrunner \(0608pe2514\) Bosch nexo Special Cordless Nutrunner \(0608pe2301\) Bosch nexo Cordless Nutrunner Nxp012qd-36v-b \(0608842010\) Bosch nexo Cordless Nutrunner Nxa065s-36v \(0608842013\) Bosch nexo Cordless Nutrunner Nxa011s-36v \(0608842011\)
CVSS	v2 : ~~unknown~~ v3 : ~~8.1~~	v2 : unknown v3 : 9.8

10 Jan 2024, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-10 11:15

Updated : 2024-01-17 20:31

NVD link : CVE-2023-48250

Mitre link : CVE-2023-48250

CVE.ORG link : CVE-2023-48250

JSON object : View

Products Affected

bosch

nexo-os
nexo_special_cordless_nutrunner_\(0608pe2514\)
nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\)
nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\)
nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\)
nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\)
nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\)
nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\)
nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\)
nexo_special_cordless_nutrunner_\(0608pe2301\)
nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\)
nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\)
nexo_special_cordless_nutrunner_\(0608pe2515\)
nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\)
nexo_special_cordless_nutrunner_\(0608pe2272\)
nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\)
nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\)
nexo_special_cordless_nutrunner_\(0608pe2666\)
nexo_special_cordless_nutrunner_\(0608pe2673\)
nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\)
nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\)

CWE

CWE-798

Use of Hard-coded Credentials

9.8 /10