CVE-2021-23842

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jan 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-238437.8The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putCVE-2021-238458.8This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was CVE-2021-238465.9When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker CVE-2021-238479.1A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive informationCVE-2021-238486.1An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker withCVE-2021-238498.8A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of aCVE-2021-23855.0Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.34 CVE-2021-238507.2A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which couCVE-2021-238517.2A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which coulCVE-2021-238524.9An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to becCVE-2021-238539.8In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.CVE-2021-238546.1An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interfa
CVE-2021-23842: High severity, CVSS 7.1 | Vulnix