CVE-2019-11892 Information

Description

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in reading or modification of the SHC’s configuration or triggering and restoring backups. In order to exploit the vulnerability the adversary needs to have successfully paired an app or service which requires user interaction.

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.0