Skip to main content

Cpp13 Firmware CVE-2023-32229

MEDIUM
Improper Write Handling in Limited-write Non-Volatile Memories (CWE-1246)
2023-06-15 psirt@bosch.com
Information Disclosure Cpp13 Firmware Cpp14 Firmware
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 15, 2023 - 11:15 nvd
MEDIUM 6.5

DescriptionNVD

Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.

AnalysisAI

Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1246. Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256. Affected products include: Bosch Cpp13 Firmware, Bosch Cpp14 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cpp13 Firmware

View all
CVE-2021-23853 CRITICAL
9.8 Jun 09

In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through

CVE-2021-23849 HIGH
8.8 Aug 05

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected s
CVE-2023-39509 HIGH
7.2 Dec 18

A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative right
CVE-2021-23854 MEDIUM
6.1 Jun 09

An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in t
CVE-2021-23848 MEDIUM
6.1 Jun 09

An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interfa
CVE-2021-23852 MEDIUM
4.9 Jun 09

An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that caus

Same weakness CWE-1246 – Improper Write Handling in Limited-write Non-Volatile Memories

View all
CVE-2024-36432 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-32229 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy