The vulnerability is caused by a platform‑specific insecure default configuration. An SSH public key that cannot be revoked is baked into the firmware’s authorized_keys file for the root user. An attacker who obtains the matching private key can authenticate to the appliance as root and gain full control of the system, including the ability to modify firmware, exfiltrate data, or disrupt service.

The affected products are Bosch BSH ELP (Electronic Platform) modules. No specific firmware version information was supplied, so all current firmware builds that include the default key are potentially vulnerable.

The CVSS score of 8.1 classifies this vulnerability as high severity. EPSS is < 1%, indicating a very low, but non-zero, exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote SSH; if an adversary knows the private key—perhaps from a separate compromise—the attacker can bypass authentication and gain root access.