CVE-2021-23847criticalCWE-287

CVE-2021-23847: fallo crítico en Bosch CPP Firmware

Unauthenticated Information Extraction Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CPP

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 1.4%
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Bosch · CPP Firmware
CVEs relacionadas — Bosch CPP Firmware

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-23851MEDIUMBuffer Overflow vulnerability in the recovery image web-based interfaceEPSS 1.6%CVE-2021-23850MEDIUMBuffer Overflow vulnerability in the recovery image telnet serverEPSS 1.6%CVE-2021-23853HIGHImproper Input Validation of HTTP HeadersEPSS 0.9%CVE-2021-23852MEDIUMDenial of Service (DoS) due to invalid web parameterEPSS 0.8%CVE-2021-23854HIGHReflected XSS in page parameterEPSS 0.6%CVE-2021-23848HIGHReflected XSS in URL handlerEPSS 0.6%