CVE-2019-11894 - CVE House

Back to Database

Status published Medium CVE-2019-11894

Improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC)

5.7 CVSS

Vulnerability Description

A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in unauthorized download of a backup. In order to exploit the vulnerability, the adversary needs to download the backup directly after a backup triggered by a legitimate user has been completed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11894

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Philip Kazmeier

References

https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html

More from Bosch

View All →

Enabling SSH server on Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Affected Vendor

Bosch

View all reports →

Affected Software

Smart Home Controller

Vulnerable Versions:

unspecified

Timeline

Official Publish: May 29th, 2019

Last Modified: September 17th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation