CVE-2021-23859

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2021
Source publication: Dec 8, 2021
Source updated: Sep 16, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

BVMS

Vendor: Bosch
Product: BVMS
Platforms: Unknown
Default status: Unknown

BVMS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	9.0.0	None listed
11.0	`affected`	custom	11.0.0	Unavailable	None listed
10.0	`affected`	custom	10.0.2	Unavailable	None listed
10.1	`affected`	custom	10.1.1	Unavailable	None listed

DIVAR IP 7000 R2

Vendor: Bosch
Product: DIVAR IP 7000 R2
Platforms: Unknown
Default status: Unknown

DIVAR IP 7000 R2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
all	`affected`	Unavailable	Unavailable	Unavailable	None listed

DIVAR IP all-in-one 5000

Vendor: Bosch
Product: DIVAR IP all-in-one 5000
Platforms: Unknown
Default status: Unknown

DIVAR IP all-in-one 5000 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
all	`affected`	Unavailable	Unavailable	Unavailable	None listed

DIVAR IP all-in-one 7000

Vendor: Bosch
Product: DIVAR IP all-in-one 7000
Platforms: Unknown
Default status: Unknown

DIVAR IP all-in-one 7000 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
all	`affected`	Unavailable	Unavailable	Unavailable	None listed

VRM

Vendor: Bosch
Product: VRM
Platforms: Unknown
Default status: Unknown

VRM · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	3.81	None listed
4.0	`affected`	custom	Unavailable	4.00.0070	None listed
3.83	`affected`	custom	Unavailable	3.83.0021	None listed
3.82	`affected`	custom	Unavailable	3.82.0057	None listed

VRM Exporter

Vendor: Bosch
Product: VRM Exporter
Platforms: Unknown
Default status: Unknown

VRM Exporter · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.1	`affected`	custom	Unavailable	2.10.0008	None listed

APE

Vendor: Bosch
Product: APE
Platforms: Unknown
Default status: Unknown

APE · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	3.8.x.x	None listed

AEC

Vendor: Bosch
Product: AEC
Platforms: Unknown
Default status: Unknown

AEC · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	2.9.1.x	None listed

BIS

Vendor: Bosch
Product: BIS
Platforms: Unknown
Default status: Unknown

BIS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	4.9	None listed
unspecified	`affected`	custom	Unavailable	4.8	None listed
unspecified	`affected`	custom	Unavailable	4.7	None listed