Vulnerability · Published Jun 9, 2021 · Assigned by bosch

CVE-2021-23847Unauthenticated Information Extraction Vulnerability

Critical 9.8

In plain English

A critical-severity improper authentication in CPP Firmware from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.4%top 26.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.

Affected products (as reported)

Vendor	Product	Versions
Bosch	CPP Firmware	7.707.72unspecified – before 7.80 B128

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html x_refsource_CONFIRM