Read the docs
TI-2019-08923 Aliases CVE-2019-11897GHSA-95r8-f778-2vmc

Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

Priority MEDIUM 41CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.

Why it matters now

EPSS 0.01782 78th percentileScored 2026-11-07
Fix Fixed IoT Gateway Software (Bosch): 9.3.0mBS SDK (ProSyst): 8.2.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BoschIoT Gateway Softwarebefore 9.3.09.3.0Patch availableCNA
ProSystmBS SDKbefore 8.2.68.2.6Patch availableCNA
  • IoT Gateway Software VendorBosch Affected before 9.3.0 Fixed in 9.3.0 Patch available CNA
  • mBS SDK VendorProSyst Affected before 8.2.6 Fixed in 8.2.6 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:bosch:iot_gateway_software:*:*:*:*:*:*:*:*before 9.3.0VulnerableBosch
cpe:2.3:a:bosch:prosyst_mbs_sdk:*:*:*:*:*:*:*:*before 8.2.6VulnerableBosch
  • cpe:2.3:a:bosch:iot_gateway_software:*:*:*:*:*:*:*:* Versions before 9.3.0 Vulnerable ·Bosch
  • cpe:2.3:a:bosch:prosyst_mbs_sdk:*:*:*:*:*:*:*:* Versions before 8.2.6 Vulnerable ·Bosch

Remediation

  • Fix · CNA IoT Gateway Software (Bosch) Fixed in 9.3.0
  • Fix · CNA mBS SDK (ProSyst) Fixed in 8.2.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11897
  2. 2026-10-03 Alias added: GHSA-95r8-f778-2vmc

References

Advisory 1

  • TI-2019-08674 Path traversal in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software CVSS 3.1HIGH 7.5
  • TI-2019-08676 Path traversal in ProSyst mBS SDK and Bosch IoT Gateway Software CVSS 3.0HIGH 7.5
  • TI-2019-08675 Leakage of stack traces in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences