Bosch PSIRT Security Advisories

Vulnerabilities in Bosch Sensortec SensorAPIs and COINES SDK

2026-08-31T00:00:00

BOSCH-SA-223618: Multiple vulnerabilities including stack-based buffer overflows, heap-based buffer overflows, and out-of-bounds reads have been identified in several Bosch Sensortec software components: the BHI360 SensorAPI, BHI385 SensorAPI, BME690 SensorAPI, and the COINES SDK. Depending on the specific vulnerability, a locally/physically positioned attacker, or a compromised peripheral device (connected via I2C, SPI, USB, or BLE), can exploit these issues to cause a Denial of Service (system crash), leak sensitive stack memory, or potentially execute arbitrary code on the host system or microcontroller.

Vulnerabilities in BSH ELP Electronic Platforms

2026-07-30T00:00:00

BOSCH-SA-943700: Multiple vulnerabilities have been identified affecting the OpenSSH service configured within BSH ELP (Electronic Platform) modules. BSH Hausgeräte GmbH is a Bosch Group brand company. These modules are utilized across various connected home appliances (such as Bosch, Siemens, Gaggenau, and Neff). The vulnerabilities include a critical signal handler race condition regression, commonly known as "regreSSHion" (CVE-2024-6387), along with historic and platform-specific logic issues. In a worst-case scenario, a successful exploitation of these vulnerabilities allows an unauthenticated, remote attacker to execute arbitrary code with root privileges on the appliance's underlying platform operating system.

Heap Buffer Write Overflow in 7-Zip bundled with PRI7000

2026-07-21T00:00:00

BOSCH-SA-466086: The GitHub Security Lab has discovered a vulnerability in 7-Zip 26.00 and older: A heap buffer overflow vulnerability (GHSL-2026-140) exists in 7-Zip version 26.00, caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to exploit this issue for arbitrary code execution or application crashes. (above excerpt from GHSL-2026-140: Heap Buffer Write Overflow in 7-Zip) The vulnerable component 7-Zip is bundled in its portable version with the Bosch Rexroth AG software PRI7000. An attacker can exploit the vulnerable component by accessing it directly on the customer PC. The PRI7000 and its other components cannot be used to exploit the vulnerability indirectly.

Vulnerabilities in Rexroth IndraWorks

2026-02-13T00:00:00

BOSCH-SA-591522: Trend Micro has identified multiple vulnerabilities in Rexroth IndraWorks which affect both, IndraWorks and utilities that are shipped as part of the package. In a worst case scenario, a successful attack leads to a remote code execution.

Multiple vulnerabilities in MAP intrusion panel

2025-11-19T00:00:00

BOSCH-SA-688644-BT: The MAP 5000 is susceptible to multiple vulnerabilities. Vulnerability CVE-2021-3449 can lead to system crashes caused by DoS attacks. Such vulnerabilities allow malicious actors to disrupt service, resulting in downtime and loss of access for legitimate users, which can severely impact business operations. Vulnerability CVE-2023-48795 constitutes a weakness in secure communication protocols, potentially exposing sensitive data to unauthorized access and manipulation. Such vulnerabilities compromise the confidentiality of information transmitted over the network and can lead to integrity issues, where data may be altered without detection.

Deprecated SSH cryptographic settings

2025-11-19T00:00:00

BOSCH-SA-359440-BT: A security issue has been identified in the Bosch MAP 5000 family of products, which stems from the use of insecure cryptographic algorithms in the SSH service configuration. It may expose systems to cryptographic attacks, unauthorized access, or data leakage.

OpenSSH DoS due to signal handler race condition

2025-11-19T00:00:00

BOSCH-SA-085467-BT: MAP 5000 is affected by an OpenSSH vulnerability which is enabled in a backwards compatibility mode. It allows remote attackers to cause a denial-of-service (DoS) by crashing the panel.

Weak Diffie-Hellman in TLS protocol

2025-11-19T00:00:00

BOSCH-SA-873110-BT: The TLS server implementation in MAP 5000 was found to use outdated settings for cryptography. The resulting weakness in the TLS protocol key exchange (Diffie-Hellman) allows an attacker to passively decrypt or intercept and manipulate secured communication. It is estimated that the required resources for a successful attack restrict the attacker profile to state-level adversaries and well-funded criminal organizations.

Denial of Service on Rexroth Fieldbus Couplers

2025-08-14T00:00:00

BOSCH-SA-757244: Several fieldbus couplers sold by Bosch Rexroth contain technology from Phoenix Contact. The manufacturer published a security bulletin about a weakness in the web-based administration interface. A successful attack leads to an overload of the device and the hardware watchdog is triggered. Process data behaves according to the configured substitute value behavior. The bus coupler requires a manual restart (resetting the power supply, pressing the reset button or executing the SNMP reset command) to reestablish communication within the Industrial Ethernet (e.g. PROFINET IO, Modbus/TCP, EtherNet/IP).

Vulnerabilities in ctrlX OS - Setup

2025-08-14T00:00:00

BOSCH-SA-129652: Vulnerabilities in ctrlX OS - Setup