Incident : Vulnerability Disclosure

BOS3343333102725

Exposure Impact

Title: Vulnerabilities Discovered in Bosch Rexroth NXA015S-36V-B Pneumatic Torque Wrenches

Description: Several vulnerabilities were found in the Bosch Rexroth NXA015S-36V-B nutrunner/pneumatic torque wrench, a device used in safety-critical manufacturing processes (e.g., automotive production lines). The vulnerabilities, discovered by Nozomi Networks, allow threat actors to implant ransomware, hijack tightening programs, and disrupt production lines. While no exploits have been reported yet, the risks include financial losses, operational disruptions, and compromised product safety. Bosch Rexroth is releasing a patch in late January 2024 to address the issues, which affect 14 versions of the Rexroth Nexo cordless nutrunner and 5 versions of the Rexo special cordless nutrunner. Some vulnerabilities score as high as 8.8 on the CVE scale and can be chained for more severe attacks.

Date Resolved: 2024-01-31

Type: Vulnerability Disclosure

Attack Vector: Unauthenticated Network AccessCustom Protocol Exploitation (Volkswagen, BMW, etc.)Web Application Vulnerabilities in Management Interface

Motivation: Potential Financial Gain (Ransomware)Industrial SabotageExtortion via Product Quality Manipulation

Incident : Vulnerability Disclosure BOS3343333102725

Entity Name: Bosch Rexroth (subsidiary of Bosch)

Entity Type: Manufacturer

Industry: Industrial Automation, Automotive Manufacturing, Engineering

Location: Germany (global operations)

Size: Large (part of Bosch Group, a multinational corporation)

Customers Affected: Volkswagen (custom protocol support), BMW (custom protocol support), Other automotive manufacturers (likely), Facilities using Rexroth Nexo nutrunners in safety-critical applications

Incident : Vulnerability Disclosure BOS3343333102725

Incident Response Plan Activated: True

Third Party Assistance: Nozomi Networks (Vulnerability Disclosure And Research).

Containment Measures: Patch development (scheduled for late January 2024)Limited disclosure of vulnerability details to allow time for patching

Remediation Measures: Software update for affected devicesCustomer advisories via RSS feed

Communication Strategy: Public statement by Bosch spokespersonCustomer notifications via advisories and RSS feedDelayed full disclosure of technical details

Incident : Vulnerability Disclosure BOS3343333102725

Ransom Demanded: Potential (scenario described but not yet observed)

Data Encryption: Potential (device takeover scenario)

Incident : Vulnerability Disclosure BOS3343333102725

Legal Actions: Potential (if vulnerabilities lead to safety incidents or defective products)

Incident : Vulnerability Disclosure BOS3343333102725

Lessons Learned: Increasing interconnectivity in production lines amplifies cyber risks in OT environments., Unauthenticated access to industrial devices can lead to severe physical and operational consequences., Safety-critical devices require robust security measures beyond traditional IT protections., Delayed disclosure of vulnerability details can provide time for mitigation but may limit collaborative defense.

Incident : Vulnerability Disclosure BOS3343333102725

Recommendations: Apply Bosch Rexroth patches immediately upon release (late January 2024)., Isolate or segment industrial devices from broader network access where possible., Monitor for unauthorized changes to device configurations or torque settings., Implement multi-factor authentication for management interfaces on OT devices., Conduct regular security assessments for interconnected production systems., Develop incident response plans specific to OT environments and safety-critical devices.Apply Bosch Rexroth patches immediately upon release (late January 2024)., Isolate or segment industrial devices from broader network access where possible., Monitor for unauthorized changes to device configurations or torque settings., Implement multi-factor authentication for management interfaces on OT devices., Conduct regular security assessments for interconnected production systems., Develop incident response plans specific to OT environments and safety-critical devices.Apply Bosch Rexroth patches immediately upon release (late January 2024)., Isolate or segment industrial devices from broader network access where possible., Monitor for unauthorized changes to device configurations or torque settings., Implement multi-factor authentication for management interfaces on OT devices., Conduct regular security assessments for interconnected production systems., Develop incident response plans specific to OT environments and safety-critical devices.Apply Bosch Rexroth patches immediately upon release (late January 2024)., Isolate or segment industrial devices from broader network access where possible., Monitor for unauthorized changes to device configurations or torque settings., Implement multi-factor authentication for management interfaces on OT devices., Conduct regular security assessments for interconnected production systems., Develop incident response plans specific to OT environments and safety-critical devices.Apply Bosch Rexroth patches immediately upon release (late January 2024)., Isolate or segment industrial devices from broader network access where possible., Monitor for unauthorized changes to device configurations or torque settings., Implement multi-factor authentication for management interfaces on OT devices., Conduct regular security assessments for interconnected production systems., Develop incident response plans specific to OT environments and safety-critical devices.Apply Bosch Rexroth patches immediately upon release (late January 2024)., Isolate or segment industrial devices from broader network access where possible., Monitor for unauthorized changes to device configurations or torque settings., Implement multi-factor authentication for management interfaces on OT devices., Conduct regular security assessments for interconnected production systems., Develop incident response plans specific to OT environments and safety-critical devices.

Incident : Vulnerability Disclosure BOS3343333102725

Source: Recorded Future News (via Nozomi Networks research)

Incident : Vulnerability Disclosure BOS3343333102725

Source: Nozomi Networks Vulnerability Advisory

Incident : Vulnerability Disclosure BOS3343333102725

Source: Bosch Rexroth Customer Advisories (RSS feed)

Incident : Vulnerability Disclosure BOS3343333102725

Investigation Status: Ongoing (patch in development, no known exploits to date)

Incident : Vulnerability Disclosure BOS3343333102725

Stakeholder Advisories: Bosch Rexroth Public Statement Acknowledging Vulnerabilities And Patch Timeline., Nozomi Networks Coordinated Disclosure With Limited Technical Details..

Customer Advisories: Notifications via Bosch Rexroth RSS feed.Urgent recommendation to install patches once available.

Incident : Vulnerability Disclosure BOS3343333102725

Entry Point: Management web application of the nutrunner device

Backdoors Established: Potential (if vulnerabilities are exploited)

High Value Targets: Automotive Production Lines, Safety-Critical Tightening Operations, Quality Assurance Processes,

Data Sold on Dark Web: Automotive Production Lines, Safety-Critical Tightening Operations, Quality Assurance Processes,

Incident : Vulnerability Disclosure BOS3343333102725

Root Causes: Insecure Management Web Application Allowing Unauthenticated Access., Lack Of Authentication For Critical Device Commands., Over-Reliance On Network Connectivity For Industrial Devices Without Adequate Safeguards.,

Corrective Actions: Software Patch To Address Authentication And Message Injection Vulnerabilities., Enhanced Monitoring For Unauthorized Configuration Changes., Review Of Custom Protocol Implementations (E.G., Volkswagen, Bmw) For Security Flaws.,