HIGH🇵🇱 Wersja polska

CVE-2021-23849

CVSS 7.5v3.1pub. 2021-08-05upd. 2024-11-21

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Bosch Aviotec
HW
Bosch
all versions
Bosch Aviotec Firmware
OS
Bosch
7.617.72
Bosch Cpp13
HW
Bosch
all versions
Bosch Cpp13 Firmware
OS
Bosch
7.75
Bosch Cpp14
HW
Bosch
all versions
Bosch Cpp14 Firmware
OS
Bosch
8.00
Bosch Cpp4
HW
Bosch
all versions
Bosch Cpp4 Firmware
OS
Bosch
7.10
Bosch Cpp6
HW
Bosch
all versions
Bosch Cpp6 Firmware
OS
Bosch
7.607.617.707.80
Bosch Cpp7
HW
Bosch
all versions
Bosch Cpp7.3
HW
Bosch
all versions
Bosch Cpp7.3 Firmware
OS
Bosch
7.607.617.627.707.727.737.80
Bosch Cpp7 Firmware
OS
Bosch
7.607.617.707.727.80

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

References

psirt.bosch.com/security-advisories/bosch-sa-033305-bt.…

psirt.bosch.com/security-advisories/bosch-sa-033305-bt.…

Related vulnerabilities

CVE-2021-23847CRITICAL9.8PL ✓same product

Pominięcie uwierzytelniania w kamerach IP Bosch CPP6/CPP7

CVE-2023-39509HIGH7.2same product

A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administra...

CVE-2021-23853HIGH8.3same product

In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP header...

CVE-2021-23854HIGH8.3same product

An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting ...

CVE-2021-23848HIGH8.3same product

An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-bas...