Nexo-os vulnerabilities
10 known vulnerabilities in Nexo-os from Bosch. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Out-of-bounds Write
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
- 8.8 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Improper Authentication
The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP re
- 8.8 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Improper Neutralization of Special Elements used in an SQL Command
The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with
- 7.5 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Missing Authorization
The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
- 9.8 Critical severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Missing Authorization
The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
- 8.8 High severity
Nexo cordless nutrunner NXA015S-36V (0608842001): Improper Limitation of a Pathname to a Restricted Directory
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE