Lucene search

[email protected]CVE-2022-32536

HistoryJun 23, 2022 - 5:15 p.m.

CVE-2022-32536

2022-06-2317:15:00

CWE-269

[email protected]

web.nvd.nist.gov

bosch

ethernet switch

pra-es8p2s

software

vulnerability

cve-2022-32536

access rights

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

42.0%

JSON

The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a non-administrator user to obtain administrator user access rights.

CPENameOperatorVersion
bosch:pra-es8p2s_firmwarebosch pra-es8p2s firmwarele1.01.05

CPE	Name	Operator	Version
bosch:pra-es8p2s_firmware	bosch pra-es8p2s firmware	le	1.01.05

References

psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html

Social References

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

42.0%

JSON

Related for CVE-2022-32536

cnvd1 prion1