CVE-2021-23859 Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products
Unauthenticated attackers can crash a service via HTTP requests, potentially enabling further unauthenticated command execution in specific Bosch video management configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-23859?
CVE-2021-23859 is a critical denial of service vulnerability in Bosch AEC, published on 8 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859
Which versions are affected by CVE-2021-23859?
It affects 6 products.
Products include Bosch Access Easy Controller Firmware, Bosch Access Professional Edition, Bosch Bosch Video Management System, Bosch Building Integration System, Bosch Video Recording Manager, Bosch Video Recording Manager Exporter.
How do I fix CVE-2021-23859?
No fix has been published for CVE-2021-23859 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-23859 being exploited?
There is no known exploitation of CVE-2021-23859 in the wild and no public exploit code.
Other vulnerabilities in Bosch AEC
Sources
Also known as GHSA-w9fc-5fg9-fgph.