#Bosch ip camera utility tool update
#Bosch ip camera utility tool upgrade

Versions 7.62 or lower and INTEOX cameras are not affected. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Use a different browser than the system default browser to open a session to the camera as there is no XSS between browsers.Īlways log out and/or close the browser (not only the tab) to clear any session dataĬVE description: A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. No links should be clicked from an untrusted external source that link back to the camera. No other websites or email content should be opened as long as the session to the camera is active When using the web based configuration interface and currently being logged in as administrator, some security precautions can be taken to mitigate XSS vulnerabilities: It is advised to use a Bosch tool like the Configuration Manager to configure the camera, that does not allow for issues like XSS. This prevents an unauthenticated attacker from accessing the interface. To mitigate the critical vulnerability CVE-2021-23847, certificate based user authentication for the camera can be used as the SSL based authentication happens, before the vulnerable component can be accessed. The camera has the possibility to whitelist networks or IP addresses to only allow access from trusted networks or IPs, preventing an attacker from accessing the camera.

#Bosch ip camera utility tool update

If an update is not possible in timely manner, users are recommended to follow the mitigations and workarounds described in the following section.ĭisallowing connections from insecure networks to the camera by means of a firewall prevents the attacker from accessing the vulnerable interface. The recommended approach is to update the affected Bosch firmware to a fixed version. Solution and Mitigations Software Updates Bosch CPP Firmware Bosch CPP Firmware 7.72 on: CPP6, CPP7, CPP7.3.

Bosch CPP Firmware 7.70 on: CPP6, CPP7, CPP7.3.Bosch CPP Firmware 7.62 on: CPP6, CPP7, CPP7.3.Bosch CPP Firmware on: CPP4, CPP6, CPP7, CPP7.3, CPP13.

These vulnerabilities were discovered by Alexander Nochvay and Andrey Muravitsky from Kaspersky ICS CERT.

#Bosch ip camera utility tool upgrade

Multiple vulnerabilities for Bosch IP cameras have been discovered in a Penetration Test from Kaspersky ICS CERT during a certification effort from Bosch.īosch rates these vulnerabilities with CVSSv3.1 base scores from 9.8 (Critical) to 4.9 (Medium), where the actual rating depends on the individual vulnerability and the final rating on the customer’s environment.Ĭustomers are strongly advised to upgrade to the fixed versions.