CVE WatchJul 30, 2026

CVE-2026-56428

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default con

CVSS

8.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Jul 30, 2026 · Last modified: Jul 30, 2026 · CWE-286

EPSS · 30d

Not enough EPSS history yet.

Technical description

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance.

Official references

psirt.bosch.comhttps://psirt.bosch.com/security-advisories/BOSCH-SA-943700.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-601356.5 MED

11.8%

——4An attacker can modify data that should be restricted to read‑only access.9h CVE-2024-292965.3 MED

66.2%

——20A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.22d