报告中涉及的扳手为博世力士乐手持式螺母拧紧器 NXA015S-36V-B，广泛运用于汽车制造行业，在正常事情的情形下，该扳手可以让工人快速将螺栓拧紧到特定的松紧度。

研究职员写道：

博世联网螺母扳手被曝23个马脚可让汽车分娩线瘫痪 汽车知识

这些漏洞可以在设备上植入打单软件，从而导致生产线歇工，并可能给资产所有者造成大规模经济丢失。

另一种利用办法可以让威胁者在操纵板载显示屏时挟制拧紧程序，对正在组装的产品造成难以察觉的破坏，或使其无法安全利用。

在论文中，研究职员得到了扳手的 root 权限，并安装了他们发明的一种名为“DR1LLCRYPT”的打单软件。

研究职员表示：

这些联网扳手一旦被入侵，本地操作员就无法利用干系按钮，而且我们有能力让联网扳手完备无法运行。

我们可以改变图形用户界面（GUI），在屏幕上显示任意信息，哀求支付赎金。
鉴于这种攻击很随意马虎在浩瀚设备上实现自动化，攻击者可以迅速使生产线上的所有工具瘫痪，从而可能对终极资产所有者造成重大毁坏。

IT之家附上漏洞列表如下：

CVE IDCWECVSS v3.1 Base ScoreCVSS v3.1 VectorCVE-2023-48252Improper Authorization (CWE-285)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2023-48253Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2023-48243Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HCVE-2023-48250Use of Hard-coded Credentials (CWE-798)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-48251Use of Hard-coded Credentials (CWE-798)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-48262Stack-based Buffer Overflow (CWE-121)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-48263Heap-based Buffer Overflow (CWE-122)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-48264Stack-based Buffer Overflow (CWE-121)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-48265Stack-based Buffer Overflow (CWE-121)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-48266Stack-based Buffer Overflow (CWE-121)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-48257Use of Weak Credentials (CWE-1391)7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2023-48242Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-48245Missing Authorization (CWE-862)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LCVE-2023-48246Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-48249Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-48255Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LCVE-2023-48248Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)5.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:LCVE-2023-48258Cross-Site Request Forgery (CSRF) (CWE-352)5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVE-2023-48244Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LCVE-2023-48247Missing Authorization (CWE-862)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2023-48254Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LCVE-2023-48256Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') (CWE-113)5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LCVE-2023-48259Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2023-48260Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2023-48261Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N