CVE-2021-23859 CRITICAL

CVE-2021-23859: Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products

Vendor Bosch
Product BVMS
Weakness CWE-703
Published December 8, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859

Key dates

02Disclosure timeline

December 8, 2021 CVE published
September 16, 2024 Record updated