Code injection

2024-01-1011:15:00

PRIOn knowledge base

www.prio-n.com

remote attacker

sd card

client-side script

crafted url

http request

victim's session

executions

poisoned file

7.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.6%

JSON

The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned file.

CPENameOperatorVersion
nexo-osge1000
nexo-osle1500

CPE	Name	Operator	Version
	nexo-os	ge	1000
	nexo-os	le	1500

References

psirt.bosch.com/security-advisories/BOSCH-SA-711465.html