CVE-2021-23859criticalCWE-703

CVE-2021-23859: fallo crítico en Bosch VRM

Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear DIVAR IP+ Monitorear DIVAR IP all-in-one

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 1.0%
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Productos afectados
Bosch · AECBosch · APEBosch · BISBosch · BVMSBosch · DIVAR IP 7000 R2Bosch · DIVAR IP all-in-one 5000Bosch · DIVAR IP all-in-one 7000Bosch · VRMBosch · VRM Exporter
CVEs relacionadas — Bosch VRM

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-29241HIGHCVE-2023-29241EPSS 0.4%CVE-2021-23843HIGHLack of authentication mechanisms on the deviceEPSS 0.2%CVE-2023-32228MEDIUMCVE-2023-32228EPSS 0.2%CVE-2021-23842MEDIUMUse of Hard-coded Cryptographic KeyEPSS 0.1%