CVE-2021-23847 - CVE House
Back to Database
Status published Critical CVE-2021-23847

Unauthenticated Information Extraction Vulnerability

Vulnerability Description

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-23847

Credits & Attribution

No credits recorded in the NVD database.

References

More from Bosch

View All →
CVE-2025-32063
Enabling SSH server on Infotainment ECU
Medium 6.8
CVE-2025-32062
Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU
High 8.8
CVE-2025-32061
Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU
High 8.8
CVE-2025-32060
Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU
Medium 6.7
CVE-2025-32059
Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU
High 8.8

Affected Vendor

Affected Software

CPP Firmware
Vulnerable Versions:
7.70, 7.72, unspecified

Timeline

Official Publish: June 9th, 2021
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access