CVE-2021-23852

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS).

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-238539.8In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.CVE-2021-238546.1An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interfaCVE-2021-238557.5The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and theCVE-2021-238566.1The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending tCVE-2021-238579.8Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the passworCVE-2021-238587.5Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resourceCVE-2021-238597.5An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS withCVE-2021-23864.3Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web AccCVE-2021-238606.1An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulneraCVE-2021-238616.5By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impCVE-2021-238627.2A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. ThiCVE-2021-238636.1HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allow
CVE-2021-23852: Medium severity, CVSS 4.9 | Vulnix