CVE-2019-11891 Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)

High 8.0 Published 29 May 2019 Updated 16 Sep 2024

Attackers with physical access can exploit incorrect privilege assignment in the app pairing mechanism to gain elevated privileges on the Bosch Smart Home Controller.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-11891?

CVE-2019-11891 is a high-severity vulnerability in Bosch Smart Home Controller, published on 29 May 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the SHC during the attack.

Weakness: CWE-269, CWE-266

Which versions are affected by CVE-2019-11891?

It affects 1 product.

Products include Bosch Smart Home Controller Firmware.

How do I fix CVE-2019-11891?

No fix has been published for CVE-2019-11891 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-11891 being exploited?

There is no known exploitation of CVE-2019-11891 in the wild and no public exploit code.

Sources

Also known as GHSA-ghfv-mcwg-v5xw.