CVE-2019-11891

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the SHC during the attack.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-269

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-118928.0A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 t CVE-2019-118938.0A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) be CVE-2019-118945.7A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 tha CVE-2019-118955.3A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 t CVE-2019-118967.1A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) CVE-2019-118978.6A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and CVE-2019-118989.9Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is disconti CVE-2019-118997.5An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. W CVE-2019-11907.8An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who successfu CVE-2019-11924.3A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins. The vulnerability al CVE-2019-119219.8An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 w CVE-2019-119228.1A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bou