What’s Vulnerable › Vulnerabilities

CVE-2021-23849: Cross Site Request Forgery (CSRF) vulnerability in web based management interface

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-05 · updated 2026-06-17
• Weakness: CWE-352

Description

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.

Affected products

• Bosch Aviotec Firmware: 7.61, 7.72
• Bosch Cpp13 Firmware: 7.75
• Bosch Cpp14 Firmware: 8.00
• Bosch Cpp4 Firmware: 7.10
• Bosch Cpp6 Firmware: 7.60, 7.61, 7.70, 7.80
• Bosch Cpp7.3 Firmware: 7.60, 7.61, 7.62, 7.70, 7.72, 7.73 (+1)
• Bosch Cpp7 Firmware: 7.60, 7.61, 7.70, 7.72, 7.80

References

• https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html
• https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html

Get alerted when CVE-2021-23849 or the next vulnerability affects your stack