CVE-2021-23846
HIGHBosch B426 Firmware - Cleartext Transmission of Sensitive Information via HTTP
Title source: llmDescription
When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM attack. This will be fixed starting from Firmware version 3.11.5, which will be released on the 30th of June, 2021.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html
Scores
CVSS v3
8.8
EPSS
0.0054
EPSS Percentile
41.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-319
Status
published
Products (4)
bosch/b426_firmware
03.01.0004
bosch/b426_firmware
03.02.002
bosch/b426_firmware
03.03.0009
bosch/b426_firmware
03.05.0003
Published
Jun 18, 2021
Tracked Since
Feb 18, 2026