« Volver al listado

CVE-2024-58330

Estado: Pendiente de análisisAlta (7.5)—

A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:N/AC:L/PR:N/UI:N indica red sin autenticación (T1190). Missing authentication permite lectura de datos de analytics (T1005); posible captura de tráfico de video (T1040).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationVulnerability ScanningUser Account ManagementPrivileged Account ManagementMulti-factor AuthenticationLimit Access to Resource Over Network

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bosch — Cpp13 IP CameraAIBosch — Cpp14 IP CameraAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-58330",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-58330",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-23T13:59:17.272517Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@bosch.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@bosch.com",
      "affectedData": [
        {
          "vendor": "Bosch",
          "product": "Camera Firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "8.91"
            }
          ],
          "platforms": [
            "CPP13"
          ]
        },
        {
          "vendor": "Bosch",
          "product": "Camera Firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "9.10"
            }
          ],
          "platforms": [
            "CPP14"
          ]
        }
      ]
    }
  ],
  "published": "2026-07-23T09:16:26.430",
  "references": [
    {
      "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-659648.html",
      "source": "psirt@bosch.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@bosch.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data."
    },
    {
      "lang": "es",
      "value": "Una verificación de autenticación faltante en cámaras IP Bosch de las familias CPP13 y CPP14 permite a un atacante no autenticado recuperar datos de eventos de análisis de video."
    }
  ],
  "lastModified": "2026-10-02T00:10:00.180",
  "sourceIdentifier": "psirt@bosch.com"
}