CVE-2021-23847
Assigner: bosch
Published: 2021-05-20T00:00:00
State: PUBLISHED
affected: platforms: CPP6, CPP7, CPP7.3
product: CPP Firmware
vendor: Bosch
versions: status: affected
version: 7.70
status: affected
version: 7.72
lessThan: 7.80 B128
status: affected
version: unspecified
versionType: custom
datePublic: 2021-05-20T00:00:00
descriptions: value: A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-287
description: CWE-287 Improper Authentication
type: CWE
source: advisory: BOSCH-SA-478243-BT 
discovery: EXTERNAL
title: Unauthenticated Information Extraction Vulnerability