Vulnerabilities > Bosch > Nexo OS

DATE CVE VULNERABILITY TITLE RISK
2024-01-10 CVE-2023-48261 SQL Injection vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
network
low complexity
bosch CWE-89
7.5
2024-01-10 CVE-2023-48262 Out-of-bounds Write vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
network
low complexity
bosch CWE-787
critical
9.8
2024-01-10 CVE-2023-48263 Out-of-bounds Write vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
network
low complexity
bosch CWE-787
critical
9.8
2024-01-10 CVE-2023-48264 Out-of-bounds Write vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
network
low complexity
bosch CWE-787
critical
9.8
2024-01-10 CVE-2023-48265 Out-of-bounds Write vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
network
low complexity
bosch CWE-787
critical
9.8
2024-01-10 CVE-2023-48266 Out-of-bounds Write vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
network
low complexity
bosch CWE-787
critical
9.8
2024-01-10 CVE-2023-48242 Path Traversal vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
network
low complexity
bosch CWE-22
6.5
2024-01-10 CVE-2023-48243 Path Traversal vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.
network
low complexity
bosch CWE-22
8.8
2024-01-10 CVE-2023-48244 Cross-site Scripting vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
network
low complexity
bosch CWE-79
6.1
2024-01-10 CVE-2023-48245 Missing Authorization vulnerability in Bosch Nexo-Os 1000/1500Sp2
The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
network
low complexity
bosch CWE-862
critical
9.8