high7.5
CVE-2021-23849
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF -…
Impact
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bosch | Cpp4 Firmware | Version 7.10 |
| Bosch | Cpp6 Firmware | Versions 7.60, 7.61, 7.70, 7.80 |
| Bosch | Aviotec Firmware | Versions 7.61, 7.72 |
| Bosch | Cpp7 Firmware | Versions 7.60, 7.61, 7.70, 7.72, 7.80 |
| Bosch | Cpp7.3 Firmware | Versions 7.60, 7.61, 7.62, 7.70, 7.72, 7.73 |
| Bosch | Cpp13 Firmware | Version 7.75 |
| Bosch | Cpp14 Firmware | Version 8.00 |