CVE-2021-23859

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859

• Bosch Access Easy Controller

  HW
  Bosch
  all versions

• Bosch Access Easy Controller Firmware

  OS
  Bosch
  ≤ 2.9.1.0

• Bosch Access Professional Edition

  APP
  Bosch
  ≤ 3.8.0

• Bosch Video Management System

  APP
  Bosch
  10.111.010.0 – 10.0.2 (excl.)≤ 9.0

• Bosch Building Integration System

  APP
  Bosch
  ≤ 4.9

• Bosch Divar Ip 5000 Firmware

  OS
  Bosch
  all versions

• Bosch Divar Ip 7000 Firmware

  OS
  Bosch
  all versions

• Bosch Video Recording Manager

  APP
  Bosch
  4.0 – 4.00.0070≤ 3.813.82 – 3.82.00573.83 – 3.83.0021

• Bosch Video Recording Manager Exporter

  APP
  Bosch
  2.1 – 2.10.0008