CVE-2019-11893

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app with restricted permissions, which required user interaction.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-269

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-118945.7A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 tha CVE-2019-118955.3A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 t CVE-2019-118967.1A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) CVE-2019-118978.6A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and CVE-2019-118989.9Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is disconti CVE-2019-118997.5An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. W CVE-2019-11907.8An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who successfu CVE-2019-11924.3A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins. The vulnerability al CVE-2019-119219.8An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 w CVE-2019-119228.1A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bou CVE-2019-119237.5In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced CVE-2019-119247.5A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resul