CVE-2018-20299
Last modified
CVE-2018-20299 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow in the RCP+ parser of the web server.. EPSS estimates a 1.89% chance of exploitation in the next 30 days.
Description
An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow in the RCP+ parser of the web server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bosch | 360-Indoor Camera Firmware | < 6.52.4 |
| Bosch | Eyes Outdoor Camera Firmware | < 6.52.4 |
References
- https://psirt.bosch.com/Advisory/BOSCH-2018-1203.htmlMitigation, Vendor Advisory
- https://psirt.bosch.com/Advisory/BOSCH-2018-1203.htmlMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-20299?
How severe is CVE-2018-20299?
How do I fix CVE-2018-20299?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-20251In WinRAR versions prior to and including 5.61, there is pat…
- CVE-2018-20252In WinRAR versions prior to and including 5.60, there is an …
- CVE-2018-20253In WinRAR versions prior to and including 5.60, There is an …
- CVE-2018-2026IBM Financial Transaction Manager 3.2.1 for Digital Payments…4.3
- CVE-2018-2028IBM Maximo Asset Management 7.6 could allow a an authenticat…6.5
- CVE-2018-20298S3 Browser before 8.1.5 contains an XML external entity (XXE…
- CVE-2018-20300Empire CMS 7.5 allows remote attackers to execute arbitrary …
- CVE-2018-20301An issue was discovered in Steve Pallen Coherence before 0.5…
- CVE-2018-20302An XSS issue was discovered in Steve Pallen Xain before 0.6.…
- CVE-2018-20303In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory…
- CVE-2018-20304wbook_addworksheet in workbook.c in libexcel.a in libexcel 0…
- CVE-2018-20305D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote co…
Are you affected by CVE-2018-20299?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST