CVE-2021-23849 Cross Site Request Forgery (CSRF) vulnerability in web based management interface
An unauthenticated attacker can trick a logged-in user into performing actions on a Bosch camera via a malicious link.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-23849?
CVE-2021-23849 is a high-severity vulnerability in Bosch CPP Firmware, published on 5 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.
Weakness: CWE-352
Which versions are affected by CVE-2021-23849?
It affects 7 products.
Products include Bosch Aviotec Firmware, Bosch Cpp13 Firmware, Bosch Cpp14 Firmware, Bosch Cpp4 Firmware, Bosch Cpp6 Firmware, Bosch Cpp7.3 Firmware and 1 more.
How do I fix CVE-2021-23849?
No fix has been published for CVE-2021-23849 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-23849 being exploited?
There is no known exploitation of CVE-2021-23849 in the wild and no public exploit code.
Sources
Also known as GHSA-5jgf-2mhc-gv7f.