Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products
CVE-2021-23859

9.1CRITICAL

Key Information:

Vendor

Bosch
Status
Bvms
Divar Ip 7000 R2
Divar Ip All-in-one 5000
Divar Ip All-in-one 7000
Vendor
CVE Published:
8 December 2021

What is CVE-2021-23859?

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859

Affected Version(s)

AEC <= 2.9.1.x

APE <= 3.8.x.x

BIS <= 4.9

References

https://psirt.bosch.com/security-advisories/bosch-sa-0434...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.