8
CVE-2019-11893
- EPSS 0.05%
- Veröffentlicht 29.05.2019 20:29:00
- Zuletzt bearbeitet 21.11.2024 04:21:58
- Quelle psirt@bosch.com
- CVE-Watchlists
- Unerledigt
LoginA potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app with restricted permissions, which required user interaction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bosch ≫ Smart Home Controller Firmware Version < 9.8.905
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.135 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8 | 2.1 | 5.9 |
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 4.9 | 4.4 | 6.4 |
AV:A/AC:M/Au:S/C:P/I:P/A:P
|
| psirt@bosch.com | 5.5 | 2.1 | 3.4 |
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
|
CWE-266 Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.