Command injection vulnerability in Bosch IP Cameras

Advisory Information

• Advisory ID: BOSCH-SA-638184-BT
• CVE Numbers and CVSS v3.1 Scores:
  • CVE-2023-39509
    • Base Score: 7.2 (High)
• Published: 13 Dec 2023
• Last Updated: 13 Dec 2023

Summary

A vulnerability was discovered in Bosch IP cameras of families CPP13 and CPP14, that allows an authenticated user with administrative rights to execute arbitrary commands in the operating system of the camera.

Affected Products

• Bosch Camera Firmware on: CPP13
  • CVE-2023-39509
    • Version(s): <= 8.90
• Bosch Camera Firmware on: CPP14
  • CVE-2023-39509
    • Version(s): 8.20 - 8.81 (including)

Solution and Mitigations

Software Updates

The recommended approach is to update the affected Bosch firmware to a fixed version. If an update is not possible in a timely manner, users are recommended to follow the mitigations and workarounds described in the following section. The versions to fix this issue are listed in the Advisory Appendix.

A reboot of the camera is required after uploading the update.

The version of the firmware should be checked after the update to confirm successful installation e.g. in the web based interface (Services - System Overview)

General Mitigation Information

To exploit this vulnerability an attacker needs administrative rights on the camera. This can be either achieved e.g. by already having the administrative rights, using insecure passwords or by conducting e.g. a phishing attack.  The security of the accounts with administrative rights should follow security best practices as an example, but not limited to:

Secure Administration

Only trusted users should have access to the administrative interface and common security rules for administrative credentials should be followed (e.g. using strong, unique passwords).

Secure Configuration Environment

It is advised to use a Bosch tool like the Configuration Manager to configure the camera, that does not allow for issues like XSS or CSRF.

When using the web based configuration interface and currently being logged in as administrator, some security precautions can be taken:

• No other websites or email content should be opened as long as the session to the camera is active

• No links should be clicked from an untrusted external source that link back to the camera.

• Use a different browser than the system default browser to open a session to the camera

• Always log out and/or close the browser (not only the tab) to clear any session data

Vulnerability Details

CVE-2023-39509

CVE description: A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera.

• Problem Type:
  • CWE-20 Improper Input Validation
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • Base Score: 7.2 (High)

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

• [1] Firmware Download Area: https://downloadstore.boschsecurity.com/index.php?type=FW

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

• 13 Dec 2023: Initial Publication

Appendix

Fixed Versions

Firmware Download

Material Lists

Bosch IP camera CPP13

Bosch IP camera CPP14