CVE-2019-11896 — Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC)

CVE-2019-11896

Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) PUBLISHED

Description (CNA)

A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app, which requires user interaction.

Affected (CNA)

Vendor / product	Versions
Bosch / Smart Home Controller	affected unspecified before 9.8.907

CWE

CWE-284

References

https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html

ADP enrichment

CVE

No English description supplied.

https://psirt.bosch.com/Advisory/BOSCH-SA-662084.html