Read the docs
TI-2024-16492 Aliases CVE-2024-25002GHSA-2r3w-v93h-m6vw

OS command injection in Bosch Network Synchronizer Enterprise

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01214 68th percentileScored 2026-11-07
Fix Fixed Network Synchronizer Enterprise (Bosch): 9.30Network Synchronizer Standard (Bosch): 9.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BoschNetwork Synchronizer Enterprisebefore 9.309.30Patch availableCNA
BoschNetwork Synchronizer Standardbefore 9.309.30Patch availableCNA
  • Network Synchronizer Enterprise VendorBosch Affected before 9.30 Fixed in 9.30 Patch available CNA
  • Network Synchronizer Standard VendorBosch Affected before 9.30 Fixed in 9.30 Patch available CNA

CPE names CISA-ADP · 2

CPEVersionsRoleVendor
cpe:2.3:a:bosch:network_synchronizer:*:*:*:*:enterprise:*:*:*——Bosch
cpe:2.3:a:bosch:network_synchronizer:*:*:*:*:standard:*:*:*——Bosch
  • cpe:2.3:a:bosch:network_synchronizer:*:*:*:*:enterprise:*:*:* Versions — — ·Bosch
  • cpe:2.3:a:bosch:network_synchronizer:*:*:*:*:standard:*:*:* Versions — — ·Bosch

Remediation

  • Fix · CNA Network Synchronizer Enterprise (Bosch) Fixed in 9.30
  • Fix · CNA Network Synchronizer Standard (Bosch) Fixed in 9.30

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25002
  2. 2026-10-03 Alias added: GHSA-2r3w-v93h-m6vw

References

Advisory 1

  • TI-2023-26130 Stack-based buffer overflow in Rexroth Nexo cordless nutrunner NXA015S-36V CVSS 3.1CRITICAL 9.8
  • TI-2023-26129 Stack-based buffer overflow in Rexroth Nexo cordless nutrunner NXA015S-36V CVSS 3.1CRITICAL 9.8
  • TI-2023-26128 Stack-based buffer overflow in Rexroth Nexo cordless nutrunner NXA015S-36V CVSS 3.1CRITICAL 9.8
  • TI-2023-26127 Heap-based buffer overflow in Rexroth Nexo cordless nutrunner NXA015S-36V CVSS 3.1CRITICAL 9.8
  • TI-2023-26126 Stack-based buffer overflow in Rexroth Nexo cordless nutrunner NXA015S-36V CVSS 3.1CRITICAL 9.8
  • TI-2023-26115 Hard-coded credentials in Rexroth Nexo cordless nutrunner NXA015S-36V CVSS 3.1CRITICAL 9.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences