Bosch Security Systems IP Cameras NXP Chip Side-Channel Key Extraction (CVE-2021-3011)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505364);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/18");

  script_cve_id("CVE-2021-3011");

  script_name(english:"Bosch Security Systems IP Cameras NXP Chip Side-Channel Key Extraction (CVE-2021-3011)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Several Bosch IP cameras are built on a hardware platform that uses an
NXP SmartMX/P5x secure element affected by an electromagnetic-wave
side-channel vulnerability. An attacker with extended physical access
to the device could recover the ECDSA private key and clone the
device. The issue resides in the built-in hardware component and has
no firmware relation: all affected platforms are impacted regardless
of the firmware version installed, and the vulnerable chip cannot be
updated. The issue only applies when customer-installed ECDSA keys are
in use (Bosch ships no default ECDSA keys). Cameras on the CPP13 and
CPP14 platforms do not use the vulnerable chip and are not affected.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://psirt.bosch.com/security-advisories/bosch-sa-762869-bt.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-3011");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(670);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/01/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/01/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:bosch:cpp4_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:bosch:cpp6_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:bosch:cpp7_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:bosch:cpp7.3_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/BoschSecuritySystems");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/BoschSecuritySystems');

var asset = tenable_ot::assets::get(vendor:'BoschSecuritySystems');

# CVE-2021-3011 is a hardware-level (NXP P5x chip) issue with no firmware relation:
# every CPP4/CPP6/CPP7/CPP7.3 camera is affected regardless of firmware version, so
# the CPEs carry no version window. CPP13/CPP14 are not affected.
var vuln_cpes = {
    "cpe:/o:bosch:cpp4_firmware" :
        {"family" : "BoschCamera"},
    "cpe:/o:bosch:cpp6_firmware" :
        {"family" : "BoschCamera"},
    "cpe:/o:bosch:cpp7_firmware" :
        {"family" : "BoschCamera"},
    "cpe:/o:bosch:cpp7.3_firmware" :
        {"family" : "BoschCamera"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_NOTE);