Bosch vulnerabilities
We track 30 vulnerabilities in Bosch products across 42 products. 30 are rated high or critical, and none are known to be exploited. The most recent was published on July 30, 2026.
Latest Bosch vulnerabilities
- 8.1 High severity
BSH ELP (Electronic Platform) Modules: Incorrect User Management
The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root us
- 7.5 High severity
Camera Firmware: Improper Access Control
A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.
- 7.5 High severity
BVMS: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network interface.
- 8.8 High severity
IndraWorks: Deserialization of Untrusted Data
A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically open
- 8.8 High severity
IndraWorks: Deserialization of Untrusted Data
A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically open
- 8.8 High severity
IndraWorks: Deserialization of Untrusted Data
A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file conta
- 8.8 High severity
IndraWorks: Deserialization of Untrusted Data
A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file cont
- 8.8 High severity
Infotainment system ECU: Stack-based Buffer Overflow
The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow w
- 8.8 High severity
Infotainment system ECU: Stack-based Buffer Overflow
The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow w
- 8.8 High severity
Infotainment system ECU: Stack-based Buffer Overflow
The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow w
- 9.3 Critical severity
Infotainment system ECU: Stack-based Buffer Overflow
The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side whi
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 8.8 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Improper Authentication
The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP re
- 8.8 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Improper Neutralization of Special Elements used in an SQL Command
The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with
- 7.5 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Missing Authorization
The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Missing Authorization
The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
- 8.8 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Improper Limitation of a Pathname to a Restricted Directory
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE
- 7.2 High severity
Camera Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera.
- 7.5 High severity
Video Recording Manager: Improper Check or Handling of Exceptional Conditions
An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation.
- 7.2 High severity
VLink Virtual Matrix Software: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitrary code execution via the admin web interface.
- 7.1 High severity
BIS: Incomplete Documentation of Program Execution
Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows local users to access data via network
- 7.7 High severity
BVMS: Incorrect Authorization
Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.
- 8.8 High severity
B420: Authentication Bypass by Spoofing
An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 pr
- 8.8 High severity
PRA-ES8P2S: Improper Privilege Management
The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a non-administrator user to obtain administrator user access rights.
- 9.8 Critical severity
PRA-ES8P2S: Improper Privilege Management
The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch.
- 9.8 Critical severity
PRA-ES8P2S: Improper Neutralization of Special Elements used in an OS Command
The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands.