CVE-2020-6780

Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly recover their plain-text passwords by brute-forcing the MD5 hash.

Score

CVSS 3.1 4.9 Medium

Status

Modified - psirt@bosch.com

Published

2021-01-26

Last modified

2024-09-17

Weaknesses

CWE-916

Affected products

• Fsm-2500 (Bosch)
• Fsm-2500 Firmware (Bosch)
• Fsm-5000 (Bosch)
• Fsm-5000 Firmware (Bosch)

References

• https://psirt.bosch.com/security-advisories/BOSCH-SA-332072-BT.html