CVE-2021-23842: Use of Hard-coded Cryptographic Key
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-23842?
CVE-2021-23842 is a vulnerability that allows an attacker to retrieve the key from the firmware and decrypt network traffic between the AMC2 and the host system.
How does CVE-2021-23842 affect Bosch AMC2 Firmware?
CVE-2021-23842 affects Bosch AMC2 Firmware by allowing an attacker to decrypt network traffic between the AMC2 and the host system.
How does CVE-2021-23842 affect Bosch Access Management System 3.0?
CVE-2021-23842 affects Bosch Access Management System 3.0 by allowing an attacker to decrypt network traffic between the AMC2 and the host system.
How severe is CVE-2021-23842?
CVE-2021-23842 has a severity score of 7.1 (high).
How can I fix CVE-2021-23842?
To fix CVE-2021-23842, it is recommended to update your Bosch AMC2 Firmware to a version that addresses the vulnerability.