Use of Hard-coded Cryptographic Key
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.
Summary
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bosch | AMS | before 4.0 | 4.0 | Patch available | CNA |
| Bosch | APE | up to 3.8.x | — | No fix listed | CNA |
| Bosch | BIS | before 4.9.1 | 4.9.1 | Patch available | CNA |
| Bosch | AMC2 | all | — | No fix listed | CNA |
- AMS VendorBosch Affected before 4.0 Fixed in 4.0 Patch available CNA
- APE VendorBosch Affected up to 3.8.x Fixed in — No fix listed CNA
- BIS VendorBosch Affected before 4.9.1 Fixed in 4.9.1 Patch available CNA
- AMC2 VendorBosch Affected all Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bosch:amc2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Bosch |
| cpe:2.3:h:bosch:amc2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:a:bosch:access_management_system:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:access_professional_edition:*:*:*:*:*:*:*:* | up to 3.8.0 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:building_integration_system:*:*:*:*:*:*:*:* | before 4.9.1 | Vulnerable | Bosch |
- cpe:2.3:o:bosch:amc2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Bosch
- cpe:2.3:h:bosch:amc2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:a:bosch:access_management_system:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Bosch
- cpe:2.3:a:bosch:access_professional_edition:*:*:*:*:*:*:*:* Versions up to 3.8.0 Vulnerable ·Bosch
- cpe:2.3:a:bosch:building_integration_system:*:*:*:*:*:*:*:* Versions before 4.9.1 Vulnerable ·Bosch
Remediation
- Fix · CNA AMS (Bosch) Fixed in 4.0
- Fix · CNA BIS (Bosch) Fixed in 4.9.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Bosch AMS, BIS 4.0, 4.9.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06207 Lack of authentication mechanisms on the devicePriority LOW 38
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23842
- 2026-10-03 Alias added: GHSA-j6hr-vmm6-m6c2
References
More Bosch Access Management System vulnerabilities
- TI-2021-06207 Lack of authentication mechanisms on the device CVSS 3.1HIGH 8.8
Sources
- CVE-2021-23842 · CVE Program
- CVE-2021-23842 · NVD
- FIRST EPSS
- GHSA-j6hr-vmm6-m6c2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences