Sign-up

ID

VAR-202206-2162


CVE

CVE-2022-32534


TITLE

Robert Bosch GmbH  of  pra-es8p2s  in the firmware  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-012363

DESCRIPTION

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands. Robert Bosch GmbH of pra-es8p2s The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Bosch Ethernet switch PRA-ES8P2S is a switch made by the German Bosch company. A remote attacker can use the vulnerability to submit special requests and execute arbitrary commands in the application context

Trust: 2.25

sources: NVD: CVE-2022-32534 // JVNDB: JVNDB-2022-012363 // CNVD: CNVD-2023-97249 // VULMON: CVE-2022-32534

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-97249

AFFECTED PRODUCTS

vendor:boschmodel:pra-es8p2sscope:lteversion:1.01.05

Trust: 1.0

vendor:robert boschmodel:pra-es8p2sscope:lteversion:pra-es8p2s firmware 1.01.05 and earlier

Trust: 0.8

vendor:robert boschmodel:pra-es8p2sscope:eqversion: -

Trust: 0.8

vendor:robert boschmodel:pra-es8p2sscope: - version: -

Trust: 0.8

vendor:boschmodel:ethernet switch pra-es8p2sscope:eqversion:1.01.05

Trust: 0.6

sources: CNVD: CNVD-2023-97249 // JVNDB: JVNDB-2022-012363 // NVD: CVE-2022-32534

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-32534
value: CRITICAL

Trust: 1.0

psirt@bosch.com: CVE-2022-32534
value: HIGH

Trust: 1.0

NVD: CVE-2022-32534
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2023-97249
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202206-2276
value: CRITICAL

Trust: 0.6

VULMON: CVE-2022-32534
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-32534
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2023-97249
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-32534
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@bosch.com: CVE-2022-32534
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-32534
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-97249 // VULMON: CVE-2022-32534 // JVNDB: JVNDB-2022-012363 // CNNVD: CNNVD-202206-2276 // NVD: CVE-2022-32534 // NVD: CVE-2022-32534

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-012363 // NVD: CVE-2022-32534

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202206-2276

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202206-2276

PATCH

title:Patch for Bosch Ethernet switch PRA-ES8P2S Web interface diagnostics command execution vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/344976

Trust: 0.6

title:Bosch Ethernet switch PRA-ES8P2S Fixes for operating system command injection vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=243838

Trust: 0.6

sources: CNVD: CNVD-2023-97249 // CNNVD: CNNVD-202206-2276

EXTERNAL IDS

db:NVDid:CVE-2022-32534

Trust: 3.9

db:JVNDBid:JVNDB-2022-012363

Trust: 0.8

db:CNVDid:CNVD-2023-97249

Trust: 0.6

db:CNNVDid:CNNVD-202206-2276

Trust: 0.6

db:VULMONid:CVE-2022-32534

Trust: 0.1

sources: CNVD: CNVD-2023-97249 // VULMON: CVE-2022-32534 // JVNDB: JVNDB-2022-012363 // CNNVD: CNNVD-202206-2276 // NVD: CVE-2022-32534

REFERENCES

url:https://psirt.bosch.com/security-advisories/bosch-sa-247052-bt.html

Trust: 3.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32534

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-32534/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/74.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2023-97249 // VULMON: CVE-2022-32534 // JVNDB: JVNDB-2022-012363 // CNNVD: CNNVD-202206-2276 // NVD: CVE-2022-32534

SOURCES

db:CNVDid:CNVD-2023-97249
db:VULMONid:CVE-2022-32534
db:JVNDBid:JVNDB-2022-012363
db:CNNVDid:CNNVD-202206-2276
db:NVDid:CVE-2022-32534

LAST UPDATE DATE

2024-08-14T14:24:41.435000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-97249date:2023-12-12T00:00:00
db:VULMONid:CVE-2022-32534date:2022-07-01T00:00:00
db:JVNDBid:JVNDB-2022-012363date:2023-08-29T08:03:00
db:CNNVDid:CNNVD-202206-2276date:2023-06-30T00:00:00
db:NVDid:CVE-2022-32534date:2023-06-29T14:24:10.490

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-97249date:2022-08-15T00:00:00
db:VULMONid:CVE-2022-32534date:2022-06-23T00:00:00
db:JVNDBid:JVNDB-2022-012363date:2023-08-29T00:00:00
db:CNNVDid:CNNVD-202206-2276date:2022-06-23T00:00:00
db:NVDid:CVE-2022-32534date:2022-06-23T17:15:13.700