Search criteria
21 vulnerabilities found for cpp7_firmware by bosch
FKIE_CVE-2022-41677
Vulnerability from fkie_nvd - Published: 2023-12-18 13:15 - Updated: 2024-11-21 07:23
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bosch | cpp14_firmware | * | |
| bosch | cpp14 | - | |
| bosch | cpp13_firmware | * | |
| bosch | cpp13 | - | |
| bosch | cpp7.3_firmware | * | |
| bosch | cpp7.3 | - | |
| bosch | cpp7_firmware | * | |
| bosch | cpp7 | - | |
| bosch | cpp6_firmware | * | |
| bosch | cpp6 | - | |
| bosch | cpp4_firmware | * | |
| bosch | cpp4 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp14_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89F54BC8-9DAE-418E-BAB3-EF5D1B5FAD8A",
"versionEndIncluding": "8.80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp14:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B7872B92-4708-4522-BA8F-5BE941D169AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp13_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F5AD0A0E-EBD7-4A76-8C84-7A023320E0BA",
"versionEndIncluding": "8.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80149FF9-3C6D-4C80-8257-CEB2BE8B0DCA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F370A3C7-01AC-46F8-A682-FFA2286B7445",
"versionEndIncluding": "7.86",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "065122F8-B39D-4DA5-BB1F-942DE35AB61E",
"versionEndIncluding": "7.86",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BFC2D04C-E319-47A8-8DA5-CA98C37852A8",
"versionEndIncluding": "7.86",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp4_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D04376BD-C049-44E6-A6D6-27BE389154C8",
"versionEndIncluding": "7.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1F4FA4F9-6BDC-44C4-A151-16ECF7926A83",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet."
},
{
"lang": "es",
"value": "Se descubri\u00f3 una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en los dispositivos de c\u00e1mara IP de Bosch que permite a un atacante no autenticado recuperar informaci\u00f3n (como capacidades) sobre el dispositivo en s\u00ed y la configuraci\u00f3n de red del dispositivo, revelando posiblemente configuraciones de red internas si el dispositivo est\u00e1 conectado a Internet."
}
],
"id": "CVE-2022-41677",
"lastModified": "2024-11-21T07:23:37.380",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-12-18T13:15:06.570",
"references": [
{
"source": "psirt@bosch.com",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html"
}
],
"sourceIdentifier": "psirt@bosch.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23849
Vulnerability from fkie_nvd - Published: 2021-08-05 20:15 - Updated: 2024-11-21 05:51
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bosch | cpp4_firmware | 7.10 | |
| bosch | cpp4 | - | |
| bosch | cpp6_firmware | 7.60 | |
| bosch | cpp6_firmware | 7.61 | |
| bosch | cpp6_firmware | 7.70 | |
| bosch | cpp6_firmware | 7.80 | |
| bosch | cpp6 | - | |
| bosch | aviotec_firmware | 7.61 | |
| bosch | aviotec_firmware | 7.72 | |
| bosch | aviotec | - | |
| bosch | cpp7_firmware | 7.60 | |
| bosch | cpp7_firmware | 7.61 | |
| bosch | cpp7_firmware | 7.70 | |
| bosch | cpp7_firmware | 7.72 | |
| bosch | cpp7_firmware | 7.80 | |
| bosch | cpp7 | - | |
| bosch | cpp7.3_firmware | 7.60 | |
| bosch | cpp7.3_firmware | 7.61 | |
| bosch | cpp7.3_firmware | 7.62 | |
| bosch | cpp7.3_firmware | 7.70 | |
| bosch | cpp7.3_firmware | 7.72 | |
| bosch | cpp7.3_firmware | 7.73 | |
| bosch | cpp7.3_firmware | 7.80 | |
| bosch | cpp7.3 | - | |
| bosch | cpp13_firmware | 7.75 | |
| bosch | cpp13 | - | |
| bosch | cpp14_firmware | 8.00 | |
| bosch | cpp14 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp4_firmware:7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "4763E6AA-5C01-4BE4-9138-167FD46A1D51",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1F4FA4F9-6BDC-44C4-A151-16ECF7926A83",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.60:*:*:*:*:*:*:*",
"matchCriteriaId": "3C677189-A4A2-428A-8EA8-58B946F00510",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.61:*:*:*:*:*:*:*",
"matchCriteriaId": "46A4537D-BBB0-44DD-9C84-A1A473F334D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "ED954BF7-DD03-4B91-8F4F-CACE2E8BDDA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.80:*:*:*:*:*:*:*",
"matchCriteriaId": "2124DC0A-3FA5-466B-8A77-A0EB67309D21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:aviotec_firmware:7.61:*:*:*:*:*:*:*",
"matchCriteriaId": "337D34D8-4576-4326-9F34-05F9CD85C0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:aviotec_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "12E564D5-BFAF-4DAC-94BB-730E0F30DB2A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:aviotec:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7065FC6-BCFB-4B62-B14D-86081EA657E8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.60:*:*:*:*:*:*:*",
"matchCriteriaId": "0D9693DA-B74A-47E6-A7AA-A037A263BC48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.61:*:*:*:*:*:*:*",
"matchCriteriaId": "C3175C41-22BE-4C7F-8EC7-6A8060ABEB66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "7DA98BAE-2029-43EF-9B62-08183FB24BC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "29E2AC5D-E6AA-4835-95A0-DE4885001BE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.80:*:*:*:*:*:*:*",
"matchCriteriaId": "D63F1A22-F19C-4100-B14A-140FBA5DAD1F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.60:*:*:*:*:*:*:*",
"matchCriteriaId": "417A3399-5CF0-47C5-9209-98F1E8CE579A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.61:*:*:*:*:*:*:*",
"matchCriteriaId": "60FBA5D6-6A6A-469C-8452-969CA5F21ADC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.62:*:*:*:*:*:*:*",
"matchCriteriaId": "F0D19012-4183-4293-B98C-292428FB6DB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "7113AE94-1C25-40AF-98F9-0A457DE063B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "B0EF3F6B-C978-4BB3-B33E-EA809CE9E851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.73:*:*:*:*:*:*:*",
"matchCriteriaId": "F74453A8-8055-4A22-98AA-F318B852B316",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.80:*:*:*:*:*:*:*",
"matchCriteriaId": "8C0DA3F8-1606-40FA-9E14-C4A53E1DE243",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp13_firmware:7.75:*:*:*:*:*:*:*",
"matchCriteriaId": "68D04488-DE68-407E-B428-5F51DEA0B07C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80149FF9-3C6D-4C80-8257-CEB2BE8B0DCA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp14_firmware:8.00:*:*:*:*:*:*:*",
"matchCriteriaId": "89AE2200-8323-4877-B709-E7B856188480",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp14:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B7872B92-4708-4522-BA8F-5BE941D169AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz basada en web permite a un atacante remoto no autenticado desencadenar acciones en un sistema afectado en nombre de otro usuario (CSRF - Cross Site Request Forgery). Esto requiere que la v\u00edctima sea enga\u00f1ada para que haga clic en un enlace malicioso o abra un sitio web malicioso mientras est\u00e1 conectado a la c\u00e1mara"
}
],
"id": "CVE-2021-23849",
"lastModified": "2024-11-21T05:51:56.493",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-05T20:15:07.947",
"references": [
{
"source": "psirt@bosch.com",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
}
],
"sourceIdentifier": "psirt@bosch.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23848
Vulnerability from fkie_nvd - Published: 2021-06-09 15:15 - Updated: 2024-11-21 05:51
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bosch | cpp4_firmware | - | |
| bosch | cpp4 | - | |
| bosch | cpp6_firmware | - | |
| bosch | cpp6 | - | |
| bosch | cpp7_firmware | - | |
| bosch | cpp7 | - | |
| bosch | cpp7.3_firmware | - | |
| bosch | cpp7.3 | - | |
| bosch | cpp13_firmware | - | |
| bosch | cpp13 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp4_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "55C25C73-B8DF-4530-B59A-375AE426D2D8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1F4FA4F9-6BDC-44C4-A151-16ECF7926A83",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2549BED9-6769-41AB-BE24-190ED45BC3C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "85D3F004-3A77-4C40-9921-B775BC487B56",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A028085E-993B-4BE2-A88A-E89AAFAE905E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp13_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4600022D-EDD1-43D2-8098-A863A1A23821",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80149FF9-3C6D-4C80-8257-CEB2BE8B0DCA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user."
},
{
"lang": "es",
"value": "Un error en el controlador de URL de las c\u00e1maras Bosch IP puede conllevar a un ataque de tipo cross site scripting (XSS) reflejado en la interfaz basada en web.\u0026#xa0;Un atacante con conocimiento de la direcci\u00f3n de la c\u00e1mara puede enviar un enlace dise\u00f1ado a un usuario, que ejecutar\u00e1 c\u00f3digo javascript en el contexto del usuario"
}
],
"id": "CVE-2021-23848",
"lastModified": "2024-11-21T05:51:56.363",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 6.0,
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-09T15:15:08.250",
"references": [
{
"source": "psirt@bosch.com",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"sourceIdentifier": "psirt@bosch.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23854
Vulnerability from fkie_nvd - Published: 2021-06-09 15:15 - Updated: 2024-11-21 05:51
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bosch | cpp6_firmware | 7.62 | |
| bosch | cpp6_firmware | 7.70 | |
| bosch | cpp6_firmware | 7.72 | |
| bosch | cpp6 | - | |
| bosch | cpp7_firmware | 7.62 | |
| bosch | cpp7_firmware | 7.70 | |
| bosch | cpp7_firmware | 7.72 | |
| bosch | cpp7 | - | |
| bosch | cpp7.3_firmware | 7.62 | |
| bosch | cpp7.3_firmware | 7.70 | |
| bosch | cpp7.3_firmware | 7.72 | |
| bosch | cpp7.3 | - | |
| bosch | cpp13_firmware | 7.75 | |
| bosch | cpp13_firmware | 7.76 | |
| bosch | cpp13 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.62:*:*:*:*:*:*:*",
"matchCriteriaId": "C96B16C2-DEAE-49E9-82A9-E78101359AC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "ED954BF7-DD03-4B91-8F4F-CACE2E8BDDA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "9E3D5E9E-A2FA-424D-893F-6D5C92F5D717",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.62:*:*:*:*:*:*:*",
"matchCriteriaId": "F081DC82-F2DD-4038-BF86-48B2781050E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "7DA98BAE-2029-43EF-9B62-08183FB24BC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "29E2AC5D-E6AA-4835-95A0-DE4885001BE6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.62:*:*:*:*:*:*:*",
"matchCriteriaId": "F0D19012-4183-4293-B98C-292428FB6DB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "7113AE94-1C25-40AF-98F9-0A457DE063B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "B0EF3F6B-C978-4BB3-B33E-EA809CE9E851",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp13_firmware:7.75:*:*:*:*:*:*:*",
"matchCriteriaId": "68D04488-DE68-407E-B428-5F51DEA0B07C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp13_firmware:7.76:*:*:*:*:*:*:*",
"matchCriteriaId": "22BF21F0-F138-41EB-88BF-FF6B051C242E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80149FF9-3C6D-4C80-8257-CEB2BE8B0DCA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected."
},
{
"lang": "es",
"value": "Un error en el manejo de un par\u00e1metro page en las c\u00e1maras Bosch IP puede conllevar a un ataque de tipo cross site scripting (XSS) reflejado en la interfaz basada en web.\u0026#xa0;Este problema solo afecta a versiones 7.7x y 7.6x.\u0026#xa0;Todas las dem\u00e1s versiones no est\u00e1n afectadas"
}
],
"id": "CVE-2021-23854",
"lastModified": "2024-11-21T05:51:57.263",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 6.0,
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-09T15:15:08.437",
"references": [
{
"source": "psirt@bosch.com",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"sourceIdentifier": "psirt@bosch.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23852
Vulnerability from fkie_nvd - Published: 2021-06-09 15:15 - Updated: 2024-11-21 05:51
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Summary
An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bosch | cpp4_firmware | - | |
| bosch | cpp4 | - | |
| bosch | cpp6_firmware | - | |
| bosch | cpp6 | - | |
| bosch | cpp7_firmware | - | |
| bosch | cpp7 | - | |
| bosch | cpp7.3_firmware | - | |
| bosch | cpp7.3 | - | |
| bosch | cpp13_firmware | - | |
| bosch | cpp13 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp4_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "55C25C73-B8DF-4530-B59A-375AE426D2D8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1F4FA4F9-6BDC-44C4-A151-16ECF7926A83",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2549BED9-6769-41AB-BE24-190ED45BC3C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "85D3F004-3A77-4C40-9921-B775BC487B56",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A028085E-993B-4BE2-A88A-E89AAFAE905E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp13_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4600022D-EDD1-43D2-8098-A863A1A23821",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80149FF9-3C6D-4C80-8257-CEB2BE8B0DCA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS)."
},
{
"lang": "es",
"value": "Un atacante autenticado con derechos de administrador de las c\u00e1maras Bosch IP pueden llamar a una URL con un par\u00e1metro invalid que causa que la c\u00e1mara deje de responder durante unos segundos y causa una Denegaci\u00f3n de servicio (DoS)"
}
],
"id": "CVE-2021-23852",
"lastModified": "2024-11-21T05:51:57.013",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-09T15:15:08.310",
"references": [
{
"source": "psirt@bosch.com",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"sourceIdentifier": "psirt@bosch.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23853
Vulnerability from fkie_nvd - Published: 2021-06-09 15:15 - Updated: 2024-11-21 05:51
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bosch | cpp4_firmware | - | |
| bosch | cpp4 | - | |
| bosch | cpp6_firmware | - | |
| bosch | cpp6 | - | |
| bosch | cpp7_firmware | - | |
| bosch | cpp7 | - | |
| bosch | cpp7.3_firmware | - | |
| bosch | cpp7.3 | - | |
| bosch | cpp13_firmware | - | |
| bosch | cpp13 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp4_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "55C25C73-B8DF-4530-B59A-375AE426D2D8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1F4FA4F9-6BDC-44C4-A151-16ECF7926A83",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2549BED9-6769-41AB-BE24-190ED45BC3C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "85D3F004-3A77-4C40-9921-B775BC487B56",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A028085E-993B-4BE2-A88A-E89AAFAE905E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp13_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4600022D-EDD1-43D2-8098-A863A1A23821",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80149FF9-3C6D-4C80-8257-CEB2BE8B0DCA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs."
},
{
"lang": "es",
"value": "En las c\u00e1maras Bosch IP, una comprobaci\u00f3n inapropiada del encabezado HTTP permite a un atacante inyectar encabezados HTTP arbitrarios por medio de URL dise\u00f1adas"
}
],
"id": "CVE-2021-23853",
"lastModified": "2024-11-21T05:51:57.130",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 6.0,
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-09T15:15:08.377",
"references": [
{
"source": "psirt@bosch.com",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"sourceIdentifier": "psirt@bosch.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23847
Vulnerability from fkie_nvd - Published: 2021-06-09 15:15 - Updated: 2024-11-21 05:51
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bosch | cpp6_firmware | * | |
| bosch | cpp6_firmware | 7.70 | |
| bosch | cpp6_firmware | 7.72 | |
| bosch | cpp6 | - | |
| bosch | cpp7_firmware | * | |
| bosch | cpp7_firmware | 7.70 | |
| bosch | cpp7_firmware | 7.72 | |
| bosch | cpp7 | - | |
| bosch | cpp7.3_firmware | * | |
| bosch | cpp7.3_firmware | 7.70 | |
| bosch | cpp7.3_firmware | 7.72 | |
| bosch | cpp7.3 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A169603C-C2A4-4345-A384-BF6B75C62849",
"versionEndExcluding": "7.80.0129",
"versionStartIncluding": "7.80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "ED954BF7-DD03-4B91-8F4F-CACE2E8BDDA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp6_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "9E3D5E9E-A2FA-424D-893F-6D5C92F5D717",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8D22B9-545A-4507-9496-ED843FD7C55B",
"versionEndExcluding": "7.80.0129",
"versionStartIncluding": "7.80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "7DA98BAE-2029-43EF-9B62-08183FB24BC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "29E2AC5D-E6AA-4835-95A0-DE4885001BE6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BAF9F4E2-BE45-40B4-A63C-75777CF63A26",
"versionEndExcluding": "7.80.0129",
"versionStartIncluding": "7.80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.70:*:*:*:*:*:*:*",
"matchCriteriaId": "7113AE94-1C25-40AF-98F9-0A457DE063B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:7.72:*:*:*:*:*:*:*",
"matchCriteriaId": "B0EF3F6B-C978-4BB3-B33E-EA809CE9E851",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected."
},
{
"lang": "es",
"value": "Una Falta de Autenticaci\u00f3n en una Funci\u00f3n Cr\u00edtica en las c\u00e1maras Bosch IP, permite a un atacante remoto no autenticado extraer informaci\u00f3n confidencial o cambiar la configuraci\u00f3n de la c\u00e1mara mediante el env\u00edo de petici\u00f3nes dise\u00f1adas al dispositivo.\u0026#xa0;Solo los dispositivos de la familia CPP6, CPP7 y CPP7.3 con versiones de firmware 7.70, 7.72 y 7.80 anteriores a B128 est\u00e1n afectados por esta vulnerabilidad.\u0026#xa0;Las versiones 7.62 o inferiores y las c\u00e1maras INTEOX no est\u00e1n afectadas"
}
],
"id": "CVE-2021-23847",
"lastModified": "2024-11-21T05:51:56.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-09T15:15:08.187",
"references": [
{
"source": "psirt@bosch.com",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"sourceIdentifier": "psirt@bosch.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "psirt@bosch.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2022-41677 (GCVE-0-2022-41677)
Vulnerability from cvelistv5 – Published: 2023-12-18 13:02 – Updated: 2024-11-27 20:36
VLAI?
Summary
An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet.
Severity ?
5.3 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | Camera Firmware |
Affected:
0 , ≤ 8.80
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:49:43.473Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html",
"tags": [
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-05T17:50:57.332237Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T20:36:39.862Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP14"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.80",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP13"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.48",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP7.3"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.86",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP7"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.86",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP6"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.86",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP4"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-18T13:02:08.943Z",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2022-41677",
"datePublished": "2023-12-18T13:02:08.943Z",
"dateReserved": "2022-09-28T07:24:23.606Z",
"dateUpdated": "2024-11-27T20:36:39.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23849 (GCVE-0-2021-23849)
Vulnerability from cvelistv5 – Published: 2021-08-05 19:23 – Updated: 2024-09-16 17:23
VLAI?
Summary
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.
Severity ?
7.5 (High)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.380Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, AVIOTEC, CPP7, CPP7.3, CPP13, CPP14"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-08-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-05T19:23:32",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Cross Site Request Forgery (CSRF) vulnerability in web based management interface",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-08-04",
"ID": "CVE-2021-23849",
"STATE": "PUBLIC",
"TITLE": "Cross Site Request Forgery (CSRF) vulnerability in web based management interface"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, AVIOTEC, CPP7, CPP7.3, CPP13, CPP14",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23849",
"datePublished": "2021-08-05T19:23:32.655475Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T17:23:27.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23854 (GCVE-0-2021-23854)
Vulnerability from cvelistv5 – Published: 2021-06-09 14:20 – Updated: 2024-09-16 17:32
VLAI?
Summary
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.
Severity ?
8.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
7.70
Affected: 7.72 Affected: 7.62 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.247Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP6, CPP7, CPP7.3"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.70"
},
{
"status": "affected",
"version": "7.72"
},
{
"status": "affected",
"version": "7.62"
}
]
},
{
"platforms": [
"CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.75"
},
{
"status": "affected",
"version": "7.76"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:20:14",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Reflected XSS in page parameter",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23854",
"STATE": "PUBLIC",
"TITLE": "Reflected XSS in page parameter"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.70"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.72"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.62"
},
{
"platform": "CPP13",
"version_affected": "=",
"version_value": "7.75"
},
{
"platform": "CPP13",
"version_affected": "=",
"version_value": "7.76"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23854",
"datePublished": "2021-06-09T14:20:14.134834Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T17:32:50.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23847 (GCVE-0-2021-23847)
Vulnerability from cvelistv5 – Published: 2021-06-09 14:19 – Updated: 2024-09-17 02:46
VLAI?
Summary
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
Severity ?
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
7.70
Affected: 7.72 Affected: unspecified , < 7.80 B128 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.274Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP6, CPP7, CPP7.3"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.70"
},
{
"status": "affected",
"version": "7.72"
},
{
"lessThan": "7.80 B128",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:19:47",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Information Extraction Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23847",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated Information Extraction Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.70"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.72"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "\u003c",
"version_value": "7.80 B128"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287 Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23847",
"datePublished": "2021-06-09T14:19:47.260870Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-17T02:46:39.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23853 (GCVE-0-2021-23853)
Vulnerability from cvelistv5 – Published: 2021-06-09 14:19 – Updated: 2024-09-17 00:25
VLAI?
Summary
In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.
Severity ?
8.3 (High)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.733Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, CPP7, CPP7.3, CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:19:24",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Improper Input Validation of HTTP Headers",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23853",
"STATE": "PUBLIC",
"TITLE": "Improper Input Validation of HTTP Headers"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, CPP7, CPP7.3, CPP13",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23853",
"datePublished": "2021-06-09T14:19:24.674361Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-17T00:25:32.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23848 (GCVE-0-2021-23848)
Vulnerability from cvelistv5 – Published: 2021-06-09 14:18 – Updated: 2024-09-16 16:27
VLAI?
Summary
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.
Severity ?
8.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.760Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, CPP7, CPP7.3, CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:18:46",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected XSS in URL handler",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23848",
"STATE": "PUBLIC",
"TITLE": "Reflected XSS in URL handler"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, CPP7, CPP7.3, CPP13",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23848",
"datePublished": "2021-06-09T14:18:46.544463Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T16:27:51.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23852 (GCVE-0-2021-23852)
Vulnerability from cvelistv5 – Published: 2021-06-09 14:18 – Updated: 2024-09-16 22:03
VLAI?
Summary
An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS).
Severity ?
4.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.365Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, CPP7, CPP7.3, CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:18:24",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Denial of Service (DoS) due to invalid web parameter",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23852",
"STATE": "PUBLIC",
"TITLE": "Denial of Service (DoS) due to invalid web parameter"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, CPP7, CPP7.3, CPP13",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS)."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-400 Uncontrolled Resource Consumption"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23852",
"datePublished": "2021-06-09T14:18:24.707515Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T22:03:24.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41677 (GCVE-0-2022-41677)
Vulnerability from nvd – Published: 2023-12-18 13:02 – Updated: 2024-11-27 20:36
VLAI?
Summary
An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet.
Severity ?
5.3 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | Camera Firmware |
Affected:
0 , ≤ 8.80
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:49:43.473Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html",
"tags": [
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-05T17:50:57.332237Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T20:36:39.862Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP14"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.80",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP13"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.48",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP7.3"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.86",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP7"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.86",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP6"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.86",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"platforms": [
"CPP4"
],
"product": "Camera Firmware",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-18T13:02:08.943Z",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-839739-BT.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2022-41677",
"datePublished": "2023-12-18T13:02:08.943Z",
"dateReserved": "2022-09-28T07:24:23.606Z",
"dateUpdated": "2024-11-27T20:36:39.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23849 (GCVE-0-2021-23849)
Vulnerability from nvd – Published: 2021-08-05 19:23 – Updated: 2024-09-16 17:23
VLAI?
Summary
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.
Severity ?
7.5 (High)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.380Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, AVIOTEC, CPP7, CPP7.3, CPP13, CPP14"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-08-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-05T19:23:32",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Cross Site Request Forgery (CSRF) vulnerability in web based management interface",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-08-04",
"ID": "CVE-2021-23849",
"STATE": "PUBLIC",
"TITLE": "Cross Site Request Forgery (CSRF) vulnerability in web based management interface"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, AVIOTEC, CPP7, CPP7.3, CPP13, CPP14",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23849",
"datePublished": "2021-08-05T19:23:32.655475Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T17:23:27.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23854 (GCVE-0-2021-23854)
Vulnerability from nvd – Published: 2021-06-09 14:20 – Updated: 2024-09-16 17:32
VLAI?
Summary
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.
Severity ?
8.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
7.70
Affected: 7.72 Affected: 7.62 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.247Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP6, CPP7, CPP7.3"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.70"
},
{
"status": "affected",
"version": "7.72"
},
{
"status": "affected",
"version": "7.62"
}
]
},
{
"platforms": [
"CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.75"
},
{
"status": "affected",
"version": "7.76"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:20:14",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Reflected XSS in page parameter",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23854",
"STATE": "PUBLIC",
"TITLE": "Reflected XSS in page parameter"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.70"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.72"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.62"
},
{
"platform": "CPP13",
"version_affected": "=",
"version_value": "7.75"
},
{
"platform": "CPP13",
"version_affected": "=",
"version_value": "7.76"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23854",
"datePublished": "2021-06-09T14:20:14.134834Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T17:32:50.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23847 (GCVE-0-2021-23847)
Vulnerability from nvd – Published: 2021-06-09 14:19 – Updated: 2024-09-17 02:46
VLAI?
Summary
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
Severity ?
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
7.70
Affected: 7.72 Affected: unspecified , < 7.80 B128 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.274Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP6, CPP7, CPP7.3"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.70"
},
{
"status": "affected",
"version": "7.72"
},
{
"lessThan": "7.80 B128",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:19:47",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Information Extraction Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23847",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated Information Extraction Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.70"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "=",
"version_value": "7.72"
},
{
"platform": "CPP6, CPP7, CPP7.3",
"version_affected": "\u003c",
"version_value": "7.80 B128"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287 Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23847",
"datePublished": "2021-06-09T14:19:47.260870Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-17T02:46:39.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23853 (GCVE-0-2021-23853)
Vulnerability from nvd – Published: 2021-06-09 14:19 – Updated: 2024-09-17 00:25
VLAI?
Summary
In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.
Severity ?
8.3 (High)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.733Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, CPP7, CPP7.3, CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:19:24",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Improper Input Validation of HTTP Headers",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23853",
"STATE": "PUBLIC",
"TITLE": "Improper Input Validation of HTTP Headers"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, CPP7, CPP7.3, CPP13",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23853",
"datePublished": "2021-06-09T14:19:24.674361Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-17T00:25:32.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23848 (GCVE-0-2021-23848)
Vulnerability from nvd – Published: 2021-06-09 14:18 – Updated: 2024-09-16 16:27
VLAI?
Summary
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.
Severity ?
8.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.760Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, CPP7, CPP7.3, CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:18:46",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected XSS in URL handler",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23848",
"STATE": "PUBLIC",
"TITLE": "Reflected XSS in URL handler"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, CPP7, CPP7.3, CPP13",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23848",
"datePublished": "2021-06-09T14:18:46.544463Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T16:27:51.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23852 (GCVE-0-2021-23852)
Vulnerability from nvd – Published: 2021-06-09 14:18 – Updated: 2024-09-16 22:03
VLAI?
Summary
An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS).
Severity ?
4.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Bosch | CPP Firmware |
Affected:
all
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:14:09.365Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"CPP4, CPP6, CPP7, CPP7.3, CPP13"
],
"product": "CPP Firmware",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2021-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T14:18:24",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
},
"title": "Denial of Service (DoS) due to invalid web parameter",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2021-05-20",
"ID": "CVE-2021-23852",
"STATE": "PUBLIC",
"TITLE": "Denial of Service (DoS) due to invalid web parameter"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CPP Firmware",
"version": {
"version_data": [
{
"platform": "CPP4, CPP6, CPP7, CPP7.3, CPP13",
"version_affected": "=",
"version_value": "all"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS)."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-400 Uncontrolled Resource Consumption"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-478243-BT",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2021-23852",
"datePublished": "2021-06-09T14:18:24.707515Z",
"dateReserved": "2021-01-12T00:00:00",
"dateUpdated": "2024-09-16T22:03:24.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}