CVE-2019-11891CWE-266

Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)

High · published May 29, 2019

CVSS v3.0
8.0
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the SHC during the attack.

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2019-05-29T19:40Z
EPSS history
Timeline
  • 29 MAY 19:40Z
    Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)
    cvelistv5