Privilege escalation in Bosch Smart Home Controller
CVE-2019-11891
A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the SHC during the attack.
EPSS: 0.005 (42.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Bosch Smart Home Controller — versions unspecified
- Bosch Smart_home_controller
- Bosch Smart_home_controller_firmware
Weakness classification (CWE)
References
- psirt@bosch.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11891?
- CVE-2019-11891 is a high-severity vulnerability in Bosch Smart Home Controller, classified under Incorrect Privilege Assignment. CVSS score: 8.0/10. Published 2019-05-29.
- How severe is CVE-2019-11891?
- High severity. CVSS v3 base score is 8.0 out of 10.