A vulnerability was found in Bosch Access Professional Edition 3.8. It has been declared as critical. This vulnerability affects an unknown code of the component Service Tools. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition (APE) 3.8.

The weakness was disclosed 09/12/2019 (Website). The advisory is shared for download at psirt.bosch.com. This vulnerability was named CVE-2019-11898 since 05/13/2019. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is needed for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1110.001.

The problem might be mitigated by replacing the product with as an alternative.

The entry VDB-141713 is pretty similar.

Productinfo

Vendor

• Bosch

Name

• Access Professional Edition

Version

• 3.8

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion