Critical severity · published Sep 12, 2019
CVE-2019-11898
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools
9.9
CVSS
1.1%
EPSS
No
On KEV
Description
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition (APE) 3.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Access · Bosch
before 3.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11898
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11898
Vendor Advisory
https://psirt.bosch.com/Advisory/BOSCH-SA-710832.html
More from Access
7.5
CVE-2019-11899
An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation