CVE-2022-47648 - Vulnerability Details - OpenCVE

An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013).

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Bosch	B420 B420 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:bosch:b420_firmware:02.02.0001:*:*:*:*:*:*:*

cpe:2.3:h:bosch:b420:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing
https://pastebin.com/raw/0CGTpiEn
https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html

History

Wed, 12 Feb 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner:

Published: 2023-02-08T00:00:00.000Z

Updated: 2025-02-12T15:59:10.466Z

Reserved: 2022-12-21T00:00:00.000Z

Link: CVE-2022-47648

Vulnrichment

Updated: 2024-08-03T15:02:36.511Z

NVD

Status : Modified

Published: 2023-02-08T21:15:10.707

Modified: 2024-11-21T07:32:18.357

Link: CVE-2022-47648

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-47648", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "state": "PUBLISHED", "dateUpdated": "2025-02-12T15:59:10.466Z", "dateReserved": "2022-12-21T00:00:00.000Z", "datePublished": "2023-02-08T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c"}, "descriptions": [{"lang": "en", "value": "An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013)."}], "affected": [{"vendor": "Bosch", "product": "B420", "versions": [{"version": "All Versions", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "tags": ["vendor-advisory"]}, {"url": "https://pastebin.com/raw/0CGTpiEn"}, {"url": "https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:02:36.511Z"}, "title": "CVE Program Container", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://pastebin.com/raw/0CGTpiEn", "tags": ["x_transferred"]}, {"url": "https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-31T17:11:38.483730Z", "id": "CVE-2022-47648", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T15:59:10.466Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-47648", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "state": "PUBLISHED", "dateUpdated": "2025-02-12T15:59:10.466Z", "dateReserved": "2022-12-21T00:00:00.000Z", "datePublished": "2023-02-08T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c"}, "descriptions": [{"lang": "en", "value": "An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013)."}], "affected": [{"vendor": "Bosch", "product": "B420", "versions": [{"version": "All Versions", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "tags": ["vendor-advisory"]}, {"url": "https://pastebin.com/raw/0CGTpiEn"}, {"url": "https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:02:36.511Z"}, "title": "CVE Program Container", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://pastebin.com/raw/0CGTpiEn", "tags": ["x_transferred"]}, {"url": "https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-47648", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-31T17:11:38.483730Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T15:59:07.264Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:bosch:b420_firmware:02.02.0001:*:*:*:*:*:*:*", "matchCriteriaId": "9B7DA704-7E31-42CE-894A-7F1F14208E14", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:bosch:b420:-:*:*:*:*:*:*:*", "matchCriteriaId": "5F84AE9E-DFCD-41BE-92B7-93501C756316", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013)."}], "id": "CVE-2022-47648", "lastModified": "2024-11-21T07:32:18.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "psirt@bosch.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-08T21:15:10.707", "references": [{"source": "psirt@bosch.com", "url": "https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing"}, {"source": "psirt@bosch.com", "url": "https://pastebin.com/raw/0CGTpiEn"}, {"source": "psirt@bosch.com", "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://pastebin.com/raw/0CGTpiEn"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html"}], "sourceIdentifier": "psirt@bosch.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@bosch.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "nvd@nist.gov", "type": "Primary"}]}