CVE-2019-11891 HIGH

CVE-2019-11891: Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)

Vendor Bosch
Product Smart Home Controller
Weakness CWE-266
Published May 29, 2019
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the SHC during the attack.

Key dates

02Disclosure timeline

May 29, 2019 CVE published
September 16, 2024 Record updated