CVE-2019-11893CWE-266

Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC)

Medium · published May 29, 2019

CVSS v3.0
5.5
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app with restricted permissions, which required user interaction.

The record
Technical detail
CVSS v3.0
5.5 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2019-05-29T19:58Z
EPSS history
Timeline
  • 29 MAY 19:58Z
    Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC)
    cvelistv5