CVE-2021-23845: B426 Web Configuration Authentication Bypass

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-18 · updated 2026-06-17
Weakness: CWE-284

Description

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from version 3.08 on, which was released on June 2019.

Affected products

Bosch B426-Cn Firmware: before 03.08 — fixed in 03.08
Bosch B426-M Firmware: before 03.10 — fixed in 03.10
Bosch B426 Firmware: before 03.08 — fixed in 03.08
Bosch B429-Cn Firmware: before 03.08 — fixed in 03.08

How to fix

Upgrade to a fixed version: Bosch B426-Cn Firmware 03.08; Bosch B426-M Firmware 03.10; Bosch B426 Firmware 03.08; Bosch B429-Cn Firmware 03.08. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-23845 or the next vulnerability affects your stack