Vulnerability in Bosch Access Easy Controller
CVE-2021-23859
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859
EPSS: 0.010 (58.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Bosch Access_easy_controller
- Bosch Access_easy_controller_firmware
- Bosch Access_professional_edition
- Bosch Aec — versions unspecified
- Bosch Ape — versions unspecified
- Bosch Bis — versions unspecified
- Bosch Bosch_video_management_system — versions 10.1, 11.0
- Bosch Building_integration_system
- Bosch Bvms — versions unspecified, 11.0, 10.0
- Bosch Divar_ip_5000_firmware
Weakness classification (CWE)
References
- psirt@bosch.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-23859?
- CVE-2021-23859 is a critical-severity vulnerability in Bosch Access Easy Controller, classified under CWE-703. CVSS score: 9.1/10. Published 2021-12-08.
- How severe is CVE-2021-23859?
- Critical severity. CVSS v3 base score is 9.1 out of 10.