CVEvulnerability

CVE-2021-23847

9.1 CRITICAL Published 2021-06-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-06-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-287, CWE-306

Description

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.

Affected configurations

• bosch cpp6 firmware (>= 7.80 < 7.80.0129) • bosch cpp6 firmware 7.70 • bosch cpp6 firmware 7.72 • bosch cpp7 firmware (>= 7.80 < 7.80.0129) • bosch cpp7 firmware 7.70 • bosch cpp7 firmware 7.72 • bosch cpp7.3 firmware (>= 7.80 < 7.80.0129) • bosch cpp7.3 firmware 7.70 • bosch cpp7.3 firmware 7.72

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References