Vulnerability in Wiegand card data interpretation

Advisory Information

• Advisory ID: BOSCH-SA-391095-BT
• CVE Numbers and CVSS v3.1 Scores:
  • CVE-2023-32228
    • Base Score: 4.6 (Medium)
• Published: 24 May 2023
• Last Updated: 24 May 2023

Summary

Bosch Access Control products AMC2-4WCF and AMC2-2WCF have a firmware bug which may lead to misinterpretation of access card data that is sent from a Wiegand reader. This may in turn lead to granting physical access to an unauthorized person. This vulnerability affects only products with Wiegand interface, i.e., not devices with OSDP / RS485 interface.

Affected Products

• Bosch AMS
  • CVE-2023-32228
    • Version(s): <= 5.0
• Bosch BIS
  • CVE-2023-32228
    • Version(s): <= 4.9.2

Solution and Mitigations

Software Updates

The recommended approach is to update the software to a fixed version as soon as possible. Firmware for Bosch AMC2 reader controllers is rolled out automatically by the update mechanism of the access management system, i.e. the Access Management System (AMS) and Building Integration System (BIS) respectively.

• BIS: update BIS installation to version BIS 5.0 (build id BIS_5.0.21100.0). This version comes with a fixed firmware for the AMC2 reader controllers. The update mechanism of the BIS will automatically roll out the firmware to all attached AMC2 reader controllers.

• AMS: First, update AMS installation to version AMS 5.0.1 (build id AMS_5.1.7.0). Then apply "Patch for CVE-2023-32228" (filename LCMV3772_v02.39.01_Wiegand.zip, TFS #389156). Follow the instructions in the Readme of the patch. The update mechanism of the AMS will automatically roll out the firmware to all attached AMC2 reader controllers.

Please check the Appendix for a list of versions numbers for each affected product.

Mitigation

Bosch has not identified any mitigating factors for this vulnerability.

Vulnerability Details

CVE-2023-32228

CVE description: A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.

• Problem Type:
  • CWE-115 Misinterpretation of Input
• CVSS Vector String: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • Base Score: 4.6 (Medium)

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

• [1] AMS Download Area: https://downloadstore.boschsecurity.com/?type=AMS
• [2] BIS Download Area: https://downloadstore.boschsecurity.com/?type=BIS
• [3] CVE-2023-32228: https://nvd.nist.gov/vuln/detail/CVE-2023-32228
• [4] Product website Access Modular Controller: https://commerce.boschsecurity.com/gb/en/AMC2-Access-Modular-Controller/p/88249915915/

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

• 24 May 2023: Initial Publication

Appendix

Fixes for the Affected Products

Products are only affected if their are used in a configuration with Wiegand access controllers, i.e. not access controllers with OSDP / RS485.

Access Management System (AMS)

Building Integration System (BIS)

Affected material

Materials are only affected if their are used in a configuration with Wiegand access controllers, i.e. not access controllers with OSDP / RS485.

AMC Reader Controllers / Reader Extensions

Please notice that firmware for Bosch AMC2 reader controllers is rolled out automatically after an update of the access management system, i.e. the Access Management System (AMS) and Building Integration System (BIS) respectively.

Access Management System (AMS)

Building Integration System (BIS)