Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an…
Priority MEDIUM 42CWE-1125Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed BCC101 (Bosch): v4.13.33BCC102 (Bosch): v4.13.33+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bosch | BCC101 | 4.13.20 to before v4.13.33 | v4.13.33 | Patch available | CNA |
| Bosch | BCC102 | 4.13.20 to before v4.13.33 | v4.13.33 | Patch available | CNA |
| Bosch | BCC50 | 4.13.20 to before v4.13.33 | v4.13.33 | Patch available | CNA |
- BCC101 VendorBosch Affected 4.13.20 to before v4.13.33 Fixed in v4.13.33 Patch available CNA
- BCC102 VendorBosch Affected 4.13.20 to before v4.13.33 Fixed in v4.13.33 Patch available CNA
- BCC50 VendorBosch Affected 4.13.20 to before v4.13.33 Fixed in v4.13.33 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bosch:bcc101_firmware:*:*:*:*:*:*:*:* | 4.13.20 to before 4.13.33 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:bcc101:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:o:bosch:bcc102_firmware:*:*:*:*:*:*:*:* | 4.13.20 to before 4.13.33 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:bcc102:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:o:bosch:bcc50_firmware:*:*:*:*:*:*:*:* | 4.13.20 to before 4.13.33 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:bcc50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
- cpe:2.3:o:bosch:bcc101_firmware:*:*:*:*:*:*:*:* Versions 4.13.20 to before 4.13.33 Vulnerable ·Bosch
- cpe:2.3:h:bosch:bcc101:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:o:bosch:bcc102_firmware:*:*:*:*:*:*:*:* Versions 4.13.20 to before 4.13.33 Vulnerable ·Bosch
- cpe:2.3:h:bosch:bcc102:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:o:bosch:bcc50_firmware:*:*:*:*:*:*:*:* Versions 4.13.20 to before 4.13.33 Vulnerable ·Bosch
- cpe:2.3:h:bosch:bcc50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
Remediation
- Fix · CNA BCC101 (Bosch) Fixed in v4.13.33
- Fix · CNA BCC102 (Bosch) Fixed in v4.13.33
- Fix · CNA BCC50 (Bosch) Fixed in v4.13.33
Timeline
- 2026-10-02 Threatist record created from CVE-2023-49722
- 2026-10-03 Alias added: GHSA-9hw3-gf6m-6pwv
References
Sources
- CVE-2023-49722 · CVE Program
- CVE-2023-49722 · NVD
- FIRST EPSS
- GHSA-9hw3-gf6m-6pwv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences