Main Vulnerability Database Vulnerabilities #VU87500

Unprotected storage of credentials in Bosch Remote Programing Software (RPS Lite) and Bosch Remote Programing Software (RPS) - CVE-2023-49263

Published: March 13, 2024

Vulnerability identifier: #VU87500

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-49263

CWE-ID: CWE-256

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due to application stored credentials in plain text in a configuration file on the system. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.

Affected software

Bosch Remote Programing Software (RPS Lite)
Bosch Remote Programing Software (RPS)

How to mitigate CVE-2023-49263

Install updates from vendor's website.

Bosch Remote Programing Software (RPS Lite) - update to 6.14.100
Bosch Remote Programing Software (RPS) - update to 6.14.100

External References

https://psirt.bosch.com/security-advisories/bosch-sa-099637-bt.html

Related Security Bulletins