CVE-2021-23847

Unauthenticated Information Extraction Vulnerability

State: Published
Severity: 9.8 Critical
Published: Jun 9, 2021
Updated: Sep 17, 2024
Reserved: Jan 12, 2021

Description

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	bosch

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
CPP FirmwareBosch	7.70Affected 7.72Affected before 7.80 B128Affected

References

https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.