CVE-2024-58023 Overview
CVE-2024-58023 is an information disclosure vulnerability in Bosch Configuration Manager version 7.72.0106. The flaw allows a local, authenticated attacker to access sensitive information stored by the application. The weakness is classified under [CWE-312] Cleartext Storage of Sensitive Information. Bosch published details in advisory BOSCH-SA-981803.
The issue affects confidentiality and integrity because disclosed data can be reused to modify system state. Exploitation requires local access and low privileges, and it does not require user interaction. The scope is marked as changed, indicating that impact extends beyond the vulnerable component.
Critical Impact
A local attacker with low privileges can read sensitive data managed by Bosch Configuration Manager 7.72.0106 and leverage it to compromise adjacent components.
Affected Products
- Bosch Configuration Manager version 7.72.0106
- Deployments relying on the affected Configuration Manager release for camera and device management
- Downstream Bosch video and security devices configured through the vulnerable Configuration Manager version
Discovery Timeline
- 2026-07-23 - CVE-2024-58023 published to the National Vulnerability Database
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2024-58023
Vulnerability Analysis
CVE-2024-58023 is an information disclosure defect in Bosch Configuration Manager 7.72.0106. The application exposes sensitive information to an actor with local access to the host running Configuration Manager. Bosch classifies the flaw under [CWE-312], which covers cleartext storage of sensitive information.
An attacker who can authenticate to the endpoint with standard user privileges can read data intended to be protected. Because the CVSS scope is changed, the disclosed information influences resources outside the Configuration Manager process itself. Recovered credentials, tokens, or configuration parameters can then be used to alter integrity of connected Bosch devices.
Root Cause
The root cause is improper protection of stored sensitive information by Bosch Configuration Manager. Data that should be encrypted or restricted through operating system access controls is instead retrievable by a local user. This condition is characteristic of [CWE-312] and typically stems from configuration files, cache artifacts, or in-memory structures written to disk without adequate protection. Refer to the Bosch Security Advisory BOSCH-SA-981803 for vendor-provided root cause details.
Attack Vector
The attack vector is local. An attacker needs an authenticated session on the host or workstation where Bosch Configuration Manager 7.72.0106 runs. No user interaction is required. Once local access is obtained, the attacker reads sensitive artifacts produced or stored by the application. Recovered material can be replayed against managed devices, expanding the blast radius beyond the initial host. See the Bosch Security Advisory BOSCH-SA-981803 for exploitation specifics.
No public proof-of-concept code is available. This section intentionally omits synthetic exploitation code because no verified samples exist in the referenced advisory.
Detection Methods for CVE-2024-58023
Indicators of Compromise
- Unexpected read access to Bosch Configuration Manager installation directories or configuration files by non-administrative local accounts.
- Reuse of Configuration Manager credentials or session tokens from hosts other than the original management workstation.
- Unauthorized changes on Bosch cameras or devices originating from accounts tied to Configuration Manager.
Detection Strategies
- Audit file system access to Bosch Configuration Manager data directories using host auditing (auditd, Windows Object Access auditing).
- Correlate local logon events on Configuration Manager hosts with subsequent access to sensitive files or process memory.
- Alert on Configuration Manager credential material appearing in unexpected process command lines or network flows.
Monitoring Recommendations
- Enable verbose logging on Bosch Configuration Manager and forward logs to a centralized SIEM for correlation.
- Monitor administrative device changes originating from Configuration Manager accounts and validate them against approved change windows.
- Track local privilege usage on hosts running Configuration Manager 7.72.0106 to identify staging behavior.
How to Mitigate CVE-2024-58023
Immediate Actions Required
- Inventory all hosts running Bosch Configuration Manager 7.72.0106 and confirm exposure to CVE-2024-58023.
- Restrict local logon rights on Configuration Manager hosts to a minimal set of trusted administrators.
- Rotate credentials, certificates, and API keys managed through Configuration Manager if unauthorized local access is suspected.
- Apply the vendor-recommended update referenced in Bosch Security Advisory BOSCH-SA-981803 as soon as it is available for your deployment.
Patch Information
Bosch has published Security Advisory BOSCH-SA-981803 covering CVE-2024-58023. Consult the advisory for the fixed release of Bosch Configuration Manager and validated upgrade procedures. Apply the fixed version to every host running the vulnerable 7.72.0106 release.
Workarounds
- Limit interactive and remote logon to Configuration Manager hosts to vetted administrators only.
- Deploy full-disk encryption and strict NTFS or POSIX permissions on directories containing Configuration Manager data.
- Segment Configuration Manager hosts on a dedicated management network to reduce lateral movement opportunities.
- Disable shared or service accounts with local logon rights on Configuration Manager systems until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
