CVE-2019-11896 - Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) · CoreCVE

Back Back to CVE browser

HIGH

Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC)

Published May 29, 2019

7.1

HIGH

CVSS 3.1

EPSS 0.67%

Description

A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app, which requires user interaction.

Affected products

Vendor Bosch Product Smart Home Controller Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <9.8.907

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Smart Home Controller

n/a

Version	Status	Constraints
unspecified	affected	<9.8.907

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-269

Improper Privilege Management

CWE-284

References (1)

https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner bosch

Published May 29, 2019

Updated Sep 16, 2024

Reserved May 13, 2019

Link CVE-2019-11896

CISA Vulnrichment

Updated n/a

Status Modified

Modified Jun 17, 2026

Link CVE-2019-11896

Severity n/a

Public date n/a

Links CVE-2019-11896