CVE-2021-23859: Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-23859?
CVE-2021-23859 is a vulnerability that allows an unauthenticated attacker to send a special HTTP request that causes a service to crash.
How does CVE-2021-23859 affect Bosch Bosch Video Management System?
CVE-2021-23859 affects Bosch Bosch Video Management System versions up to 9.0, as well as versions from 10.0 to 10.0.2, 10.1, and 11.0.
How does CVE-2021-23859 affect Bosch Video Recording Manager?
CVE-2021-23859 affects Bosch Video Recording Manager versions up to 3.81, as well as versions from 3.82 to 3.82.0057, 3.83 to 3.83.0021, and 4.0 to 4.00.0070.
What is the severity of CVE-2021-23859?
The severity of CVE-2021-23859 is critical, with a CVSS score of 7.5.
How can I fix CVE-2021-23859?
To fix CVE-2021-23859, it is recommended to upgrade to the latest version of the affected software when available or apply any patches or security updates provided by the vendor.