CVE-2023-32229 : Due to an error in the software interface to the secure element chip on Bosch IP

Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.

Published 2023-06-15 11:15:09

Updated 2023-07-05 15:31:04

Source Robert Bosch GmbH

View at NVD, CVE.org

Products affected by CVE-2023-32229

Bosch » Cpp13 Firmware
Versions before (<) 8.48.0017
cpe:2.3:o:bosch:cpp13_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Bosch » Autodome 7000i » Version: N/A
When used together with: Bosch » Autodome 7100 Ir » Version: N/A
When used together with: Bosch » Autodome Inteox 7000i » Version: N/A
When used together with: Bosch » Dinion Inteox 7100i Ir » Version: N/A
When used together with: Bosch » Flexidome Inteox 7100i Ir » Version: N/A
When used together with: Bosch » Mic Inteox 7100i » Version: N/A
Bosch » Cpp14 Firmware
Versions from including (>=) 8.50 and before (<) 8.80.0090
cpe:2.3:o:bosch:cpp14_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Bosch » Dinion 7100i Ir » Version: N/A
When used together with: Bosch » Flexidome Indoor 5100i » Version: N/A
When used together with: Bosch » Flexidome Indoor 5100i Ir » Version: N/A
When used together with: Bosch » Flexidome Multi 7000i » Version: N/A
When used together with: Bosch » Flexidome Multi 7000i Ir » Version: N/A
When used together with: Bosch » Flexidome Outdoor 5100i » Version: N/A
When used together with: Bosch » Flexidome Outdoor 5100i Ir » Version: N/A
When used together with: Bosch » Flexidome Panoramic 5100i » Version: N/A
When used together with: Bosch » Flexidome Panoramic 5100i Ir » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-32229

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-32229

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	1.2	3.6	Robert Bosch GmbH
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-32229

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: nvd@nist.gov (Primary)
CWE-1246 Improper Write Handling in Limited-write Non-Volatile Memories

The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.

Assigned by: psirt@bosch.com (Secondary)

References for CVE-2023-32229

https://psirt.bosch.com/security-advisories/BOSCH-SA-435698-BT.html

Possible damage of secure element in Bosch IP cameras | Bosch PSIRT
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-32229

Products affected by CVE-2023-32229

Exploit prediction scoring system (EPSS) score for CVE-2023-32229

CVSS scores for CVE-2023-32229

CWE ids for CVE-2023-32229

References for CVE-2023-32229