CVE-2021-23847

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-238486.1An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with CVE-2021-238498.8A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of a CVE-2021-23855.0Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.34 CVE-2021-238507.2A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which cou CVE-2021-238517.2A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which coul CVE-2021-238524.9An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to bec CVE-2021-238539.8In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.CVE-2021-238546.1An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interfa CVE-2021-238557.5The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and the CVE-2021-238566.1The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending t CVE-2021-238579.8Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the passwor CVE-2021-238587.5Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource