CVE-2019-11891 - CVE House

Back to Database

Status published High CVE-2019-11891

Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)

8 CVSS

Vulnerability Description

A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the SHC during the attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11891

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Philip Kazmeier

References

https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html

More from Bosch

View All →

Enabling SSH server on Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Affected Vendor

Bosch

View all reports →

Affected Software

Smart Home Controller

Vulnerable Versions:

unspecified

Timeline

Official Publish: May 29th, 2019

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1078 Valid Accounts

T1098 Account Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Privilege Escalation

T1484 Domain or Tenant Policy Modification

Defense Evasion

T1021 Remote Services

Lateral Movement