CVE-2019-11896CWE-284

Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC)

Medium · published May 29, 2019

CVSS v3.0
5.5
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app, which requires user interaction.

The record
Technical detail
CVSS v3.0
5.5 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00674 · 51.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2019-05-29T20:11Z
EPSS history
Timeline
  • 29 MAY 20:11Z
    Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC)
    cvelistv5