CVE-2021-23850: medium-severity vulnerability in Bosch CPP Firmware
Buffer Overflow vulnerability in the recovery image telnet server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 1.6%
A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Bosch · CPP FirmwareRelated CVEs — Bosch CPP Firmware
In the same product, most dangerous first.
CVE-2021-23851MEDIUMBuffer Overflow vulnerability in the recovery image web-based interfaceEPSS 1.6%CVE-2021-23847CRITICALUnauthenticated Information Extraction VulnerabilityEPSS 1.4%CVE-2021-23853HIGHImproper Input Validation of HTTP HeadersEPSS 0.9%CVE-2021-23852MEDIUMDenial of Service (DoS) due to invalid web parameterEPSS 0.8%CVE-2021-23854HIGHReflected XSS in page parameterEPSS 0.6%CVE-2021-23848HIGHReflected XSS in URL handlerEPSS 0.6%