Bosch PSIRT
organizationDE01
references
Other names and identifiers for this entity.
bosch_psirtDE psirt@bosch.com
02
assessed vulnerabilities (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-14266US | high7.8 | Exploit | ||
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… | ||||
| CVE-2026-48095US | — | Exploit | ||
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed s… | ||||
| CVE-2025-48862US | —OT elevated | — | ||
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the pr… | ||||
| CVE-2025-48861US | — | — | ||
A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including poten… | ||||
| CVE-2025-48860US | — | — | ||
A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a… | ||||
| CVE-2025-2813US | — | — | ||
An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. | ||||
| CVE-2025-27532US | —OT elevated | — | ||
A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via m… | ||||
| CVE-2025-24351US | — | — | ||
A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arbitrary OS commands in… | ||||
| CVE-2025-24350US | — | — | ||
A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary certifica… | ||||
| CVE-2025-24349US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete the configuration of p… | ||||
| CVE-2025-24348US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the wireless netw… | ||||
| CVE-2025-24347US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network confi… | ||||
| CVE-2025-24346US | — | — | ||
A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file via… | ||||
| CVE-2025-24345US | — | — | ||
A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “hosts” file in an uninten… | ||||
| CVE-2025-24344US | — | — | ||
A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute… | ||||
| CVE-2025-24343US | — | — | ||
A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary files in arbit… | ||||
| CVE-2025-24342US | — | — | ||
A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests. | ||||
| CVE-2025-24341US | — | — | ||
A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the device via multiple… | ||||
| CVE-2025-24340US | — | — | ||
A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users. | ||||
| CVE-2025-24339US | — | — | ||
A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache p… | ||||