8.8

CVE-2023-48253

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request.
By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bosch ≫ Nexo-os Version >= 1000 <= 1500-sp2
   Bosch ≫ Nexo Cordless Nutrunner Nxa011s-36v-b (0608842012) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa011s-36v (0608842011) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa015s-36v-b (0608842006) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa015s-36v (0608842001) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa030s-36v-b (0608842007) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa030s-36v (0608842002) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa050s-36v-b (0608842008) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa050s-36v (0608842003) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa065s-36v-b (0608842014) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxa065s-36v (0608842013) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxp012qd-36v-b (0608842010) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxp012qd-36v (0608842005) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxv012t-36v-b (0608842016) Version-
   Bosch ≫ Nexo Cordless Nutrunner Nxv012t-36v (0608842015) Version-
   Bosch ≫ Nexo Special Cordless Nutrunner (0608pe2272) Version-
   Bosch ≫ Nexo Special Cordless Nutrunner (0608pe2301) Version-
   Bosch ≫ Nexo Special Cordless Nutrunner (0608pe2514) Version-
   Bosch ≫ Nexo Special Cordless Nutrunner (0608pe2515) Version-
   Bosch ≫ Nexo Special Cordless Nutrunner (0608pe2666) Version-
   Bosch ≫ Nexo Special Cordless Nutrunner (0608pe2673) Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.81% 0.735
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
psirt@bosch.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.