Vulnerability in Bosch Access Easy Controller
CVE-2021-23859
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (60.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Bosch Access Easy Controller
- Bosch Access Easy Controller Firmware
- Bosch Access Professional Edition
- Bosch Aec — versions unspecified
- Bosch Ape — versions unspecified
- Bosch Bis — versions unspecified
- Bosch Video Management System — versions 10.1, 11.0
- Bosch Building Integration System
- Bosch Bvms — versions unspecified, 11.0, 10.0
- Bosch Divar Ip 5000 Firmware
Weakness classification (CWE)
References
- psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-23859?
- CVE-2021-23859 is a critical-severity vulnerability in Bosch Access Easy Controller, classified under CWE-703. CVSS score: 9.1/10. Published 2021-12-08.
- How severe is CVE-2021-23859?
- Critical severity. CVSS v3 base score is 9.1 out of 10.