XSS in Bosch Cpp13
CVE-2021-23854
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.006 (42.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Bosch Cpp13
- Bosch Cpp13_firmware — versions 7.75, 7.76
- Bosch Cpp6
- Bosch Cpp6_firmware — versions 7.62, 7.70, 7.72
- Bosch Cpp7
- Bosch Cpp7.3
- Bosch Cpp7.3_firmware — versions 7.62, 7.70, 7.72
- Bosch Cpp7_firmware — versions 7.62, 7.70, 7.72
- Bosch Cpp Firmware — versions 7.70, 7.72, 7.62
Weakness classification (CWE)
References
- psirt@bosch.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-23854?
- CVE-2021-23854 is a high-severity vulnerability in Bosch Cpp13, classified under Cross-site Scripting. CVSS score: 8.3/10. Published 2021-06-09.
- How severe is CVE-2021-23854?
- High severity. CVSS v3 base score is 8.3 out of 10.