Vulnerability Description
A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app with restricted permissions, which required user interaction.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bosch | Smart Home Controller Firmware | < 9.8.905 |
| Bosch | Smart Home Controller | - |
Related Weaknesses (CWE)
References
- https://psirt.bosch.com/Advisory/BOSCH-SA-662084.htmlVendor Advisory
- https://psirt.bosch.com/Advisory/BOSCH-SA-662084.htmlVendor Advisory
FAQ
What is CVE-2019-11893?
CVE-2019-11893 is a vulnerability with a CVSS score of 8.0 (HIGH). A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining d...
How severe is CVE-2019-11893?
CVE-2019-11893 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11893?
Check the references section above for vendor advisories and patch information. Affected products include: Bosch Smart Home Controller Firmware, Bosch Smart Home Controller.