What is the CVSS score of EUVD-2026-51108?

EUVD-2026-51108 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of BSH ELP Modules are affected by EUVD-2026-51108?

Bosch BSH ELP modules contain a hardcoded SSH key vulnerability that enables unrestricted root access to any organization's connected appliances over the network, directly threatening device…. A patch is available.

How to fix or mitigate EUVD-2026-51108?

Within 24 hours, inventory all Bosch BSH ELP modules in your environment and isolate them on a segmented network if operationally feasible; concurrently, restrict SSH access to these devices via firewall rules blocking inbound port 22 from untrusted networks. Within 7 days, escalate to Bosch support for emergency patched firmware or formal advisory; in parallel, disable SSH access entirely if not required for operations, and implement continuous network monitoring for unauthorized SSH connection attempts to these appliances. Within 30 days, deploy any released security patches immediately upon availability, or execute replacement of affected modules with patched alternatives if Bosch does not provide an update.

BSH ELP Modules EUVD-2026-51108

| CVE-2026-56428 HIGH

Incorrect User Management (CWE-286)

2026-07-30 bosch

GHSA-vx42-7w84-65c6

Authentication Bypass Bsh Elp Electronic Platform Modules Bosch

8.1

CVSS 3.1 · Vendor: bosch

Severity by source

Vendor (bosch) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

SSH over network (AV:N) with no valid account needed (PR:N), but the attacker must first obtain the specific private key (AC:H); root access yields full C/I/A loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (bosch).

CVSS VectorVendor: bosch

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:51 vuln.today

CVE Published

Jul 30, 2026 - 13:11 cve.org

HIGH 8.1

DescriptionCVE.org

The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance.

AnalysisAI

Authentication bypass to root in Bosch BSH ELP (Electronic Platform) modules stems from a hardcoded, non-revocable SSH public key baked into the firmware's authorized_keys file for the root user. Any attacker holding the matching private key can SSH in and obtain full root-level control of the appliance over the network with no legitimate credentials. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the shared static-key design means a single leak of the private key would compromise every affected device at once.

Technical ContextAI

The affected component is the SSH daemon on Bosch BSH ELP embedded platform modules (CPE cpe:2.3:a:bosch:bsh_elp_(electronic_platform)_modules). The root cause maps to CWE-286 (Incorrect User Management): the firmware ships a fixed public key in the root user's authorized_keys file, permitting public-key authentication as root to anyone possessing the corresponding private key. Because the key is embedded at build time and described as non-revocable, it behaves as an undocumented backdoor credential shared across the firmware image rather than a per-device or rotatable secret - a hardcoded-credential pattern applied to SSH key auth rather than a password.

RemediationAI

Follow Bosch PSIRT advisory BOSCH-SA-943700 (https://psirt.bosch.com/security-advisories/BOSCH-SA-943700.html) and apply the firmware update Bosch designates as fixed; an exact patched version is not confirmed in the supplied data, so treat the advisory as the source of truth. Because the embedded key is described as non-revocable, removing or replacing the root authorized_keys entry is the core fix and generally requires a corrected firmware image rather than in-place key rotation. As compensating controls until patched, restrict SSH (TCP 22) reachability to a trusted management VLAN or via firewall ACLs so only authorized hosts can reach the service, disable SSH entirely on the module if it is not operationally required (trade-off: loss of remote management/maintenance access), and monitor for root SSH public-key logins as an abuse indicator. Note that blocking or disabling SSH may break legitimate vendor servicing workflows.