Information Disclosure in Bosch Android Client Application

CVE-2023-45321

What is CVE-2023-45321?

The Bosch Android Client application, when configured using method 1 that allows users to manually input the server IP address, utilizes HTTP to retrieve sensitive information such as IP addresses and authentication credentials for remote MQTT broker access. This lack of encryption in HTTP, which is not configurable by users, permits an attacker positioned within the same subnet as the HMI device to intercept critical username and password data. Consequently, this exposes the remote management protocol to potential unauthorized access, raising significant security concerns.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References