Bosch Thermotechnik GmbH — F0:4A:3D (MA-L)

Bosch Thermotechnik GmbH holds a single MA-L block, OUI prefix F0:4A:3D, registered to the company's seat at Sophienstraße 30-32, 35576 Wetzlar, Germany. This is the heating, hot-water, and air-conditioning division of the Robert Bosch group; since 1 April 2023 it has traded commercially as the "Bosch Home Comfort Group," but the legal entity Bosch Thermotechnik GmbH is unchanged, and the IEEE registration still carries the older name. A MAC address in the F0:4A:3D range therefore points to a Bosch HVAC connectivity device rather than to Bosch's video-surveillance or general smart-home lines. The two confirmed device families drawing from this block are the BCC-series Wi-Fi room thermostats (BCC50/BCC100/BCC101/BCC102) — 24 VAC connected thermostats with app and cloud integration — and the IP Gateway G10-3 (FCC ID 2AODDIPGWG10-3), a 2.4 GHz 802.11 b/g/n dongle that brings Bosch split-unit air conditioners onto a home network for remote control. Both are small embedded IoT endpoints that make outbound connections to Bosch's cloud back-end. The security caveat is material: the BCC50/BCC101/BCC102 thermostats are subject to CVE-2023-49722 (CVSS 8.3 High, Bosch PSIRT advisory BOSCH-SA-473852), in which TCP port 8899 was left open on the Wi-Fi microcontroller, allowing unauthenticated LAN clients to issue arbitrary commands or push malicious firmware; it is fixed in firmware 4.13.33. An F0:4A:3D MAC observed on a network is thus a prompt to verify the device's firmware version. As with all MA-L OUIs, IEEE publishes no registration date for this block, so no allocated date is recorded; any "date registered" shown by third-party lookup tools is a database artifact, not an IEEE fact.

IEEE assignment

F0:4A:3D → Bosch Thermotechnik GmbH, Wetzlar, DE [Confirmed] — enrichment/registries/oui.csv line 399; corroborated by netify.ai and maclookup.app

Registry / block size

MA-L (24-bit OUI); single registered prefix for this registrant [Confirmed] — oui.csv (MA-L); registrant absent from mam.csv (MA-M) and oui36.csv (MA-S). NOTE: IEEE's public OUI data publishes NO assignment/registration date (oui.csv columns are only Registry, Assignment, Organization Name, Organization Address); any "date registered" on third-party tools (e.g. maclookup.app) is a database artifact, not an IEEE fact.

HQ / country

Sophienstraße 30-32, 35576 Wetzlar, Germany [Confirmed] — IEEE MA-L registry address; en.wikipedia.org/wiki/Bosch_Thermotechnik

Company status

active; legal entity Bosch Thermotechnik GmbH, trading commercially as "Bosch Home Comfort Group" since 1 April 2023; subsidiary of Robert Bosch GmbH [Confirmed] — bosch-homecomfort.com, en.wikipedia.org/wiki/Bosch_Thermotechnik

Device types

HVAC connectivity gateways and Wi-Fi thermostats — BCC50/BCC100/BCC101/BCC102 connected thermostats; IP Gateway G10-3 (Wi-Fi adapter for split-unit air conditioners) [Confirmed] — fccid.io/2AODDIPGWG10-3, bosch-homecomfort.com

Notable products

IP Gateway G10-3 (Wi-Fi adapter for split-AC units), BCC50/BCC100/BCC101/BCC102 connected Wi-Fi thermostats, IDS Premium Connected heat-pump platform [Confirmed] — fccid.io/2AODDIPGWG10-3, hvacinsider.com

Industry

HVAC / building automation / smart home — heating, ventilation and air conditioning with IoT connectivity [Confirmed] — en.wikipedia.org/wiki/Bosch_Thermotechnik; AWS case study (Bosch uses AWS IoT Core for connectivity-gateway OTA)

Parent / related vendors

parent Robert Bosch GmbH (holds separate OUIs, e.g. 44:36:59); Robert Bosch Smart Home GmbH (64:DA:A0); Bosch Security Systems (00:04:63, 00:01:31); Bosch Sicherheitssysteme GmbH (30:F0:28) [Confirmed parent; Likely on the specific related-OUI mappings] — en.wikipedia.org/wiki/Bosch_Thermotechnik; netify.ai (single-source for the related-prefix list)

Security context

CVE-2023-49722 (CVSS 8.3 High, published 2024-01-09, Bosch PSIRT advisory BOSCH-SA-473852) affects BCC50/BCC101/BCC102 thermostats — TCP port 8899 left open on the Wi-Fi MCU permits unauthenticated LAN command/firmware injection; fixed in firmware 4.13.33. No CVE published against the G10-3 IP gateway specifically. [Confirmed] — thehackernews.com, psirt.bosch.com, darkreading.com

Analyst note

An F0:4A:3D MAC indicates a Bosch Thermotechnik HVAC connectivity device — almost certainly a BCC-series Wi-Fi thermostat or a G10-3 IP gateway for a split-unit air conditioner; both are residential/light-commercial IoT devices with cloud back-ends. Verify firmware ≥ 4.13.33 on BCC-series thermostats (CVE-2023-49722). German subsidiary of Robert Bosch GmbH — no sanctions/covered-entity concern. Not to be confused with Bosch Security Systems (surveillance/access control) or Robert Bosch Smart Home GmbH (64:DA:A0).