Read the docs
TI-2021-06212 Aliases CVE-2021-23849GHSA-5jgf-2mhc-gv7f

Cross Site Request Forgery (CSRF) vulnerability in web based management interface

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.

Why it matters now

EPSS 0.00487 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BoschCPP Firmwareall—No fix listedCNA
  • CPP Firmware VendorBosch Affected all Fixed in — No fix listed CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:o:bosch:cpp4_firmware:7.10:*:*:*:*:*:*:*7.10VulnerableBosch
cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:*not specified by NVDRunning onBosch
cpe:2.3:o:bosch:cpp6_firmware:7.60:*:*:*:*:*:*:*7.60VulnerableBosch
cpe:2.3:o:bosch:cpp6_firmware:7.61:*:*:*:*:*:*:*7.61VulnerableBosch
cpe:2.3:o:bosch:cpp6_firmware:7.70:*:*:*:*:*:*:*7.70VulnerableBosch
cpe:2.3:o:bosch:cpp6_firmware:7.80:*:*:*:*:*:*:*7.80VulnerableBosch
cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*not specified by NVDRunning onBosch
cpe:2.3:o:bosch:aviotec_firmware:7.61:*:*:*:*:*:*:*7.61VulnerableBosch
cpe:2.3:o:bosch:aviotec_firmware:7.72:*:*:*:*:*:*:*7.72VulnerableBosch
cpe:2.3:h:bosch:aviotec:-:*:*:*:*:*:*:*not specified by NVDRunning onBosch
  • cpe:2.3:o:bosch:cpp4_firmware:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·Bosch
  • cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
  • cpe:2.3:o:bosch:cpp6_firmware:7.60:*:*:*:*:*:*:* Versions 7.60 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp6_firmware:7.61:*:*:*:*:*:*:* Versions 7.61 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp6_firmware:7.70:*:*:*:*:*:*:* Versions 7.70 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp6_firmware:7.80:*:*:*:*:*:*:* Versions 7.80 Vulnerable ·Bosch
  • cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
  • cpe:2.3:o:bosch:aviotec_firmware:7.61:*:*:*:*:*:*:* Versions 7.61 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:aviotec_firmware:7.72:*:*:*:*:*:*:* Versions 7.72 Vulnerable ·Bosch
  • cpe:2.3:h:bosch:aviotec:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:bosch:cpp7_firmware:7.60:*:*:*:*:*:*:*7.60VulnerableBosch
cpe:2.3:o:bosch:cpp7_firmware:7.61:*:*:*:*:*:*:*7.61VulnerableBosch
cpe:2.3:o:bosch:cpp7_firmware:7.70:*:*:*:*:*:*:*7.70VulnerableBosch
cpe:2.3:o:bosch:cpp7_firmware:7.72:*:*:*:*:*:*:*7.72VulnerableBosch
cpe:2.3:o:bosch:cpp7_firmware:7.80:*:*:*:*:*:*:*7.80VulnerableBosch
cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*not specified by NVDRunning onBosch
cpe:2.3:o:bosch:cpp7.3_firmware:7.60:*:*:*:*:*:*:*7.60VulnerableBosch
cpe:2.3:o:bosch:cpp7.3_firmware:7.61:*:*:*:*:*:*:*7.61VulnerableBosch
cpe:2.3:o:bosch:cpp7.3_firmware:7.62:*:*:*:*:*:*:*7.62VulnerableBosch
cpe:2.3:o:bosch:cpp7.3_firmware:7.70:*:*:*:*:*:*:*7.70VulnerableBosch
cpe:2.3:o:bosch:cpp7.3_firmware:7.72:*:*:*:*:*:*:*7.72VulnerableBosch
cpe:2.3:o:bosch:cpp7.3_firmware:7.73:*:*:*:*:*:*:*7.73VulnerableBosch
cpe:2.3:o:bosch:cpp7.3_firmware:7.80:*:*:*:*:*:*:*7.80VulnerableBosch
cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*not specified by NVDRunning onBosch
cpe:2.3:o:bosch:cpp13_firmware:7.75:*:*:*:*:*:*:*7.75VulnerableBosch
cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*not specified by NVDRunning onBosch
cpe:2.3:o:bosch:cpp14_firmware:8.00:*:*:*:*:*:*:*8.00VulnerableBosch
cpe:2.3:h:bosch:cpp14:-:*:*:*:*:*:*:*not specified by NVDRunning onBosch
  • cpe:2.3:o:bosch:cpp7_firmware:7.60:*:*:*:*:*:*:* Versions 7.60 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7_firmware:7.61:*:*:*:*:*:*:* Versions 7.61 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7_firmware:7.70:*:*:*:*:*:*:* Versions 7.70 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7_firmware:7.72:*:*:*:*:*:*:* Versions 7.72 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7_firmware:7.80:*:*:*:*:*:*:* Versions 7.80 Vulnerable ·Bosch
  • cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
  • cpe:2.3:o:bosch:cpp7.3_firmware:7.60:*:*:*:*:*:*:* Versions 7.60 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7.3_firmware:7.61:*:*:*:*:*:*:* Versions 7.61 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7.3_firmware:7.62:*:*:*:*:*:*:* Versions 7.62 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7.3_firmware:7.70:*:*:*:*:*:*:* Versions 7.70 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7.3_firmware:7.72:*:*:*:*:*:*:* Versions 7.72 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7.3_firmware:7.73:*:*:*:*:*:*:* Versions 7.73 Vulnerable ·Bosch
  • cpe:2.3:o:bosch:cpp7.3_firmware:7.80:*:*:*:*:*:*:* Versions 7.80 Vulnerable ·Bosch
  • cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
  • cpe:2.3:o:bosch:cpp13_firmware:7.75:*:*:*:*:*:*:* Versions 7.75 Vulnerable ·Bosch
  • cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
  • cpe:2.3:o:bosch:cpp14_firmware:8.00:*:*:*:*:*:*:* Versions 8.00 Vulnerable ·Bosch
  • cpe:2.3:h:bosch:cpp14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23849
  2. 2026-10-03 Alias added: GHSA-5jgf-2mhc-gv7f

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences