CVE-2019-11897: Bosch IoT Gateway Software

High severity, CVSS 8.6. EPSS: 1.8% chance of exploitation in the next 30 days.

A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.

Affected products

• Bosch IoT Gateway Software: before 9.3.0 (fixed in 9.3.0)
• Bosch Prosyst Mbs SDK: before 8.2.6 (fixed in 8.2.6)

Published 2019-08-21. Last modified 2026-06-17.