{"id":"CVE-2021-23849","aliases":["EUVD-2021-10775","GHSA-5jgf-2mhc-gv7f"],"status":"published","title":"Cross Site Request Forgery (CSRF) vulnerability in web based management interface","description":"A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00487,"percentile":0.42436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2021-08-05T19:23:32Z","modified":"2026-06-17T03:38:55Z","products":[{"vendor":"bosch","product":"aviotec_firmware"},{"vendor":"bosch","product":"cpp firmware"},{"vendor":"bosch","product":"cpp13_firmware"},{"vendor":"bosch","product":"cpp14_firmware"},{"vendor":"bosch","product":"cpp4_firmware"},{"vendor":"bosch","product":"cpp6_firmware"},{"vendor":"bosch","product":"cpp7.3_firmware"},{"vendor":"bosch","product":"cpp7_firmware"}],"references":[{"url":"https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23849"},{"url":"https://github.com/advisories/GHSA-5jgf-2mhc-gv7f"}],"sources":{"cve":[{"id":"CVE-2021-23849","title":"Cross Site Request Forgery (CSRF) vulnerability in web based management interface","description":"A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.","status":"published","published":"2021-08-05T19:23:32.655Z","modified":"2024-09-16T17:23:27.843Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-10775","description":"A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.","status":"published","published":"2021-08-05T19:23:32Z","modified":"2024-09-16T17:23:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:42.486621Z"}],"ghsa":[{"id":"GHSA-5jgf-2mhc-gv7f","title":"A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger...","description":"A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.","status":"published","published":"2022-05-24T19:10:13Z","modified":"2023-01-30T05:01:14Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:46:22.009402Z"}],"nvd":[{"id":"CVE-2021-23849","description":"A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.","status":"published","published":"2021-08-05T20:15:07.947Z","modified":"2026-06-17T03:38:55.707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:06:56.562207Z"}]}}