CVE Watch30 jul 2026

CVE-2026-56428

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default con

CVSS

8.1

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 30 jul 2026 · Última mod.: 30 jul 2026 · CWE-286

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance.

Referencias oficiales

psirt.bosch.comhttps://psirt.bosch.com/security-advisories/BOSCH-SA-943700.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-601356.5 MED

11.8%

——4An attacker can modify data that should be restricted to read‑only access.11h CVE-2024-292965.3 MED

66.2%

——20A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.22d