PT-2019-12550 · Bosch · Bosch Smart Home Controller

Philip Kazmeier · Publicado 2019-05-29 · Atualizado 2020-10-06 · CVE-2019-11893

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bosch Smart Home Controller (SHC) versions prior to 9.8.905

Description A potential incorrect privilege assignment issue exists in the app permission update API, which may allow a restricted app to obtain default app permissions. To exploit this, an adversary must first successfully pair an app with restricted permissions, requiring user interaction.

Recommendations For versions prior to 9.8.905, update to version 9.8.905 or later to resolve the issue. As a temporary workaround, consider restricting app pairing to minimize the risk of exploitation.

Correção

Improper Privilege Management

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-269

CWE-266

Identificadores relacionados

CVE-2019-11893

Produtos afetados

Bosch Smart Home Controller

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-11893 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11893 · Nota de Segurança
• https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html · Aviso do Fabricante