CVE-2021-23847

🗓️ 09 Jun 2021 14:19:47Reported by boschType

Missing Authentication in Critical Function in Bosch IP cameras allowing unauthenticated remote attacker to extract sensitive info or change settings by sending crafted requests

Reporter	Title	Published	Views	Family All 7
CNNVD	Bosch IP cameras 访问控制错误漏洞	9 Jun 202100:00	–	cnnvd
Cvelist	CVE-2021-23847 Unauthenticated Information Extraction Vulnerability	9 Jun 202114:19	–	cvelist
EUVD	EUVD-2021-10773	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in Bosch IP Cameras	10 Jun 202100:00	–	ncsc
NVD	CVE-2021-23847	9 Jun 202115:15	–	nvd
OSV	CVE-2021-23847	9 Jun 202115:15	–	osv
Prion	Authentication flaw	9 Jun 202115:15	–	prion

NVD

Node

bosch cpp6_firmwareRange7.80–7.80.0129

bosch cpp6_firmwareMatch7.70

bosch cpp6_firmwareMatch7.72

AND

bosch cpp6Match-

Node

bosch cpp7_firmwareRange7.80–7.80.0129

bosch cpp7_firmwareMatch7.70

bosch cpp7_firmwareMatch7.72

AND

bosch cpp7Match-

Node

bosch cpp7.3_firmwareRange7.80–7.80.0129

bosch cpp7.3_firmwareMatch7.70

bosch cpp7.3_firmwareMatch7.72

AND

bosch cpp7.3Match-

[
  {
    "platforms": [
      "CPP6, CPP7, CPP7.3"
    ],
    "product": "CPP Firmware",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "7.70"
      },
      {
        "status": "affected",
        "version": "7.72"
      },
      {
        "lessThan": "7.80 B128",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
psirt	www.psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html

21 Nov 2024 05:51Current

9.2High risk

Vulners AI Score9.2

CVSS 26.4

CVSS 3.19.1 - 9.8

EPSS0.00456

cve-2021-23847 bosch ip cameras missing authentication remote attacker sensitive information crafted requests vulnerability firmware 7.70 7.72 7.80 prior to b128