CVE-2021-23848: high-severity vulnerability in Bosch CPP Firmware
Reflected XSS in URL handler
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.3epss 0.6%
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Bosch · CPP FirmwareRelated CVEs — Bosch CPP Firmware
In the same product, most dangerous first.
CVE-2021-23851MEDIUMBuffer Overflow vulnerability in the recovery image web-based interfaceEPSS 1.6%CVE-2021-23850MEDIUMBuffer Overflow vulnerability in the recovery image telnet serverEPSS 1.6%CVE-2021-23847CRITICALUnauthenticated Information Extraction VulnerabilityEPSS 1.4%CVE-2021-23853HIGHImproper Input Validation of HTTP HeadersEPSS 0.9%CVE-2021-23852MEDIUMDenial of Service (DoS) due to invalid web parameterEPSS 0.8%CVE-2021-23854HIGHReflected XSS in page parameterEPSS 0.6%