CVE-2019-11893: Bosch Smart Home Controller Firmware

High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days.

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have successfully paired an app with restricted permissions, which required user interaction.

Affected products

• Bosch Smart Home Controller Firmware: before 9.8.905 (fixed in 9.8.905)

Published 2019-05-29. Last modified 2026-06-17.