description: An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet.
problem types: CWE-284 Improper Access Control
affected:
{
vendor: Bosch
product: Camera Firmware
platforms: CPP14
versions:
version: 0, status: affected, versionType: custom, lessThanOrEqual: 8.80
}
{
vendor: Bosch
product: Camera Firmware
platforms: CPP13
versions:
version: 0, status: affected, versionType: custom, lessThanOrEqual: 8.48
}
{
vendor: Bosch
product: Camera Firmware
platforms: CPP7.3
versions:
version: 0, status: affected, versionType: custom, lessThanOrEqual: 7.86
}
{
vendor: Bosch
product: Camera Firmware
platforms: CPP7
versions:
version: 0, status: affected, versionType: custom, lessThanOrEqual: 7.86
}
{
vendor: Bosch
product: Camera Firmware
platforms: CPP6
versions:
version: 0, status: affected, versionType: custom, lessThanOrEqual: 7.86
}
{
vendor: Bosch
product: Camera Firmware
platforms: CPP4
versions:
version: 0, status: affected, versionType: custom, lessThanOrEqual: 7.10
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
]