Critical severity · published Jun 9, 2021
CVE-2021-23847
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by…
9.1
CVSS
1.4%
EPSS
No
On KEV
Description
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cpp6 Firmware · Bosch
7.80 before 7.80.0129; 7.70; 7.72 · source: NVD
CF
Cpp7 Firmware · Bosch
7.80 before 7.80.0129; 7.70; 7.72 · source: NVD
CF
Cpp7.3 Firmware · Bosch
7.80 before 7.80.0129; 7.70; 7.72 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23847
Vendor Advisory
https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
More from Cpp6 Firmware
9.8
CVE-2021-23853
In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs
8.8
CVE-2021-23849
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request…
6.1
CVE-2021-23854
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface
6.1
CVE-2021-23848
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface
5.3
CVE-2022-41677
An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device…