CVE-2023-39509 is a command injection vulnerability (CWE-77) affecting Bosch IP cameras built on the CPP13 and CPP14 camera platforms: an authenticated user who already holds administrative rights on the device can abuse the flaw to run arbitrary operating-system commands, escalating a legitimate but limited administrative session into full control of the camera's underlying Linux-based firmware. Both Bosch and NVD independently score it 7.2 (high) on CVSS v3.1.
Vulnerability summary
7.2
High
1.5%
EPSS score (FIRST)
No
CISA KEV catalog
2023-12-18
Published
Vulnerability ID: CVE-2023-39509 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Bosch IP camera firmware, CPP13 and CPP14 platform families | — | CPP13 firmware up to and including 8.90; CPP14 firmware 8.20 through 8.81; fixed in CPP13 8.90.0037 and CPP14 9.00.0210, per Bosch advisory BOSCH-SA-638184-BT |
What does this mean for affected devices?
CVE-2023-39509 (CWE-77, Improper Neutralization of Special Elements used in a Command) affects Bosch IP cameras built on the CPP13 and CPP14 camera platform families. NVD's description states: "A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera" (NVD).
Bosch's own security advisory, BOSCH-SA-638184-BT, published 13 December 2023, lists the affected firmware as CPP13 up to and including version 8.90, and CPP14 versions 8.20 through 8.81; the fix is available in CPP13 firmware 8.90.0037 and CPP14 firmware 9.00.0210. Bosch recommends updating to the fixed firmware and, as general hardening, using strong unique administrative passwords and restricting access to the camera's administrative interface to trusted users only (Bosch Security Advisory BOSCH-SA-638184-BT).
Both Bosch's own PSIRT ([email protected]) and NVD ([email protected]) independently publish the same CVSS v3.1 score of 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — so this page shows that figure as NVD-confirmed. The PR:H component means exploitation requires the attacker to already hold administrative credentials on the camera, which limits the practical attack surface to insiders or attackers who have already compromised an admin account (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01472 (73.95th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
Operators of affected Bosch IP cameras should update to CPP13 firmware 8.90.0037, CPP14 firmware 9.00.0210, or later, and should treat administrative credentials for these cameras with the same care as root access to a Linux host.
Evidence
- A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera. — NVD
- Affects CPP13 firmware up to and including 8.90 and CPP14 firmware 8.20 through 8.81; fixed in CPP13 8.90.0037 and CPP14 9.00.0210; advisory recommends strong unique passwords and restricting administrative access to trusted users. — Bosch Security Advisory BOSCH-SA-638184-BT
- NVD's own Primary CVSS v3.1 score is 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, matching Bosch's own Secondary score. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01472 (73.95th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
