CVE-2021-23847: Unauthenticated Information Extraction Vulnerability

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-09 · updated 2026-06-17
Weakness: CWE-287

Description

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.

Affected products

Bosch Cpp6 Firmware: from 7.80 before 7.80.0129; 7.70, 7.72 — fixed in 7.80.0129
Bosch Cpp7.3 Firmware: from 7.80 before 7.80.0129; 7.70, 7.72 — fixed in 7.80.0129
Bosch Cpp7 Firmware: from 7.80 before 7.80.0129; 7.70, 7.72 — fixed in 7.80.0129

How to fix

Upgrade to a fixed version: Bosch Cpp6 Firmware 7.80.0129; Bosch Cpp7.3 Firmware 7.80.0129; Bosch Cpp7 Firmware 7.80.0129. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-23847 or the next vulnerability affects your stack