CVE-2021-23847 Unauthenticated Information Extraction Vulnerability
Unauthenticated attackers can extract sensitive information or modify settings on Bosch IP cameras by sending crafted requests to the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-23847?
CVE-2021-23847 is a critical missing authorization vulnerability in Bosch CPP Firmware, published on 9 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
Which versions are affected by CVE-2021-23847?
It affects 3 products.
Products include Bosch Cpp6 Firmware, Bosch Cpp7.3 Firmware, Bosch Cpp7 Firmware.
How do I fix CVE-2021-23847?
No fix has been published for CVE-2021-23847 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-23847 being exploited?
There is no known exploitation of CVE-2021-23847 in the wild and no public exploit code.
Sources
Also known as GHSA-222p-ppph-c5v8.