Remote command execution vulnerability in Bosch's Android Client for HMI devices

CVE-2023-46102

What is CVE-2023-46102?

The Android Client application by Bosch, when connected to the AppHub server, utilizes a flawed implementation of the MQTT protocol for device management. The communication relies on encryption via a hard-coded DES symmetric key, which can be easily extracted through reverse engineering of the client and server applications. This vulnerability allows an attacker controlling an unauthorized MQTT broker on the same network to send crafted messages, potentially executing arbitrary commands on the HMI device. This poses substantial risks, enabling malicious actors to manipulate device operations without authentication.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References