CVSS 3.1
8.0 highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2019-11893
High (8.0) in bosch smart home controller firmware. EPSS 0.4% chance of exploitation in the next 30 days.
A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app with restricted permissions, which required user interaction.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-269, CWE-266
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bosch:smart_home_controller_firmware