CVE-2019-11895

The CVE-2019-11895 entry concerns an improper access control vulnerability in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) prior to 9.8.905, which can lead to denial of service affecting the SHC and connected sensors/actuators. Exposure requires the attacker to have already pai...

CVE-2019-11892

The CVE-2019-11892 issue affects the Bosch Smart Home Controller (SHC) JSON-RPC interface. Affected component: SHC’s JSON-RPC layer. Root cause: improper access control could allow reading or modification of SHC configuration and could trigger and restore backups. Exploitation requirements: an at...

CVE-2019-11896

CVE-2019-11896 affects the Bosch Smart Home Controller (SHC) via the 3rd-party pairing mechanism prior to version 9.8.907. The root issue is an incorrect privilege assignment that can allow a restricted app to acquire default app permissions after a successful app pairing, which requires user int...

CVE-2019-11894

CVE-2019-11894 concerns an improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC) prior to version 9.8.905. An attacker could download a backup directly after a legitimate backup completes, potentially exposing sensitive data. The public documents confirm the aff...

CVE-2019-11893

The CVE-2019-11893 entry describes an incorrect privilege assignment vulnerability in the Bosch Smart Home Controller (SHC) app permission update API. Affected product: Bosch SHC prior to version 9.8.905. Vulnerable component: the app permission update API where privilege assignments can be misap...

CVE-2019-11891

CVE-2019-11891 affects the Bosch Smart Home Controller (SHC) prior to version 9.8.905, with an incorrect privilege assignment in the app pairing mechanism that can lead to elevated privileges. Exploitation requires physical access to the SHC. The issue is described with a high-severity impact ( c...