CVE-2023-48251

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-48251
The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:bosch:nexo-os:*:*:*:*:*:*:*:*
OR cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2272\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2301\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2514\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2515\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2666\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2673\):-:*:*:*:*:*:*:*
History

17 Jan 2024, 20:32

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad permite a un atacante remoto autenticarse en el servicio SSH con privilegios de root a través de una cuenta oculta codificada.
References () https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html - () https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html - Vendor Advisory
First Time Bosch nexo Cordless Nutrunner Nxv012t-36v-b \(0608842016\)
Bosch nexo Special Cordless Nutrunner \(0608pe2666\)
Bosch nexo Cordless Nutrunner Nxv012t-36v \(0608842015\)
Bosch nexo Cordless Nutrunner Nxa050s-36v \(0608842003\)
Bosch nexo Cordless Nutrunner Nxa030s-36v \(0608842002\)
Bosch
Bosch nexo Cordless Nutrunner Nxa030s-36v-b \(0608842007\)
Bosch nexo Cordless Nutrunner Nxp012qd-36v \(0608842005\)
Bosch nexo-os
Bosch nexo Special Cordless Nutrunner \(0608pe2515\)
Bosch nexo Cordless Nutrunner Nxa011s-36v-b \(0608842012\)
Bosch nexo Special Cordless Nutrunner \(0608pe2673\)
Bosch nexo Cordless Nutrunner Nxa015s-36v-b \(0608842006\)
Bosch nexo Cordless Nutrunner Nxa050s-36v-b \(0608842008\)
Bosch nexo Cordless Nutrunner Nxa065s-36v-b \(0608842014\)
Bosch nexo Cordless Nutrunner Nxa015s-36v \(0608842001\)
Bosch nexo Special Cordless Nutrunner \(0608pe2272\)
Bosch nexo Special Cordless Nutrunner \(0608pe2514\)
Bosch nexo Special Cordless Nutrunner \(0608pe2301\)
Bosch nexo Cordless Nutrunner Nxp012qd-36v-b \(0608842010\)
Bosch nexo Cordless Nutrunner Nxa065s-36v \(0608842013\)
Bosch nexo Cordless Nutrunner Nxa011s-36v \(0608842011\)
CVSS v2 : unknown
v3 : 8.1 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2272\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\):-:*:*:*:*:*:*:*
cpe:2.3:o:bosch:nexo-os:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2666\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2301\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2515\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2514\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2673\):-:*:*:*:*:*:*:*

10 Jan 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-10 13:15

Updated : 2024-01-17 20:32

NVD link : CVE-2023-48251

Mitre link : CVE-2023-48251

CVE.ORG link : CVE-2023-48251

JSON object : View

Products Affected

bosch

  • nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\)
  • nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\)
  • nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\)
  • nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\)
  • nexo_special_cordless_nutrunner_\(0608pe2673\)
  • nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\)
  • nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\)
  • nexo-os
  • nexo_special_cordless_nutrunner_\(0608pe2515\)
  • nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\)
  • nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\)
  • nexo_special_cordless_nutrunner_\(0608pe2301\)
  • nexo_special_cordless_nutrunner_\(0608pe2272\)
  • nexo_special_cordless_nutrunner_\(0608pe2514\)
  • nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\)
  • nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\)
  • nexo_special_cordless_nutrunner_\(0608pe2666\)
  • nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\)
  • nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\)
  • nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\)
  • nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\)
CWE
CWE-798

Use of Hard-coded Credentials