1. Home
  2. CVE Database
  3. CVE-2023-48253
HIGH · 8.8

CVE-2023-48253

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to...

Vulnerability Description

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
BoschNexo-Os>= 1000, <= 1500-sp2
BoschNexo Cordless Nutrunner Nxa011S-36V-B \(0608842012\)-
BoschNexo Cordless Nutrunner Nxa011S-36V \(0608842011\)-
BoschNexo Cordless Nutrunner Nxa015S-36V-B \(0608842006\)-
BoschNexo Cordless Nutrunner Nxa015S-36V \(0608842001\)-
BoschNexo Cordless Nutrunner Nxa030S-36V-B \(0608842007\)-
BoschNexo Cordless Nutrunner Nxa030S-36V \(0608842002\)-
BoschNexo Cordless Nutrunner Nxa050S-36V-B \(0608842008\)-
BoschNexo Cordless Nutrunner Nxa050S-36V \(0608842003\)-
BoschNexo Cordless Nutrunner Nxa065S-36V-B \(0608842014\)-
BoschNexo Cordless Nutrunner Nxa065S-36V \(0608842013\)-
BoschNexo Cordless Nutrunner Nxp012Qd-36V-B \(0608842010\)-
BoschNexo Cordless Nutrunner Nxp012Qd-36V \(0608842005\)-
BoschNexo Cordless Nutrunner Nxv012T-36V-B \(0608842016\)-
BoschNexo Cordless Nutrunner Nxv012T-36V \(0608842015\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2272\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2301\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2514\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2515\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2666\)-

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2023-48253?

CVE-2023-48253 is a vulnerability with a CVSS score of 8.8 (HIGH). The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to...

How severe is CVE-2023-48253?

CVE-2023-48253 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-48253?

Check the references section above for vendor advisories and patch information. Affected products include: Bosch Nexo-Os, Bosch Nexo Cordless Nutrunner Nxa011S-36V-B \(0608842012\), Bosch Nexo Cordless Nutrunner Nxa011S-36V \(0608842011\), Bosch Nexo Cordless Nutrunner Nxa015S-36V-B \(0608842006\), Bosch Nexo Cordless Nutrunner Nxa015S-36V \(0608842001\).