CVE-2024-58330: Bosch IP Camera Auth Bypass Vulnerability

CVE-2024-58330 Overview

CVE-2024-58330 is a missing authentication vulnerability affecting Bosch IP cameras in the CPP13 and CPP14 device families. The flaw permits an unauthenticated remote attacker to retrieve video analytics event data directly from the camera. Because no credentials are required and the attack is network-based, exposure of camera endpoints to untrusted networks meaningfully raises the risk of surveillance data disclosure. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
An unauthenticated network-adjacent attacker can retrieve video analytics event data from affected Bosch CPP13 and CPP14 IP cameras, resulting in confidentiality loss of surveillance metadata.

Affected Products

Bosch IP cameras based on the CPP13 platform
Bosch IP cameras based on the CPP14 platform
Refer to the Bosch Security Advisory BOSCH-SA-659648 for the complete list of affected models and firmware versions

Discovery Timeline

2026-07-23 - CVE-2024-58330 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2024-58330

Vulnerability Analysis

The vulnerability stems from a missing authentication check on an interface that exposes video analytics event data. Bosch IP cameras in the CPP13 and CPP14 families run onboard video content analysis (VCA) that generates events such as motion, object classification, line-crossing, and loitering detections. Access to these events should require valid device credentials.

Because the affected endpoint does not enforce authentication, any client that can reach the camera over the network can request and receive the analytics event stream. The attacker does not need user interaction, elevated privileges, or knowledge of a session token. Confidentiality is impacted, while data integrity and camera availability are not affected by this specific flaw.

The issue is a classic access control failure ([CWE-284]) rather than a memory-safety or injection defect. Vendor-supplied firmware updates enforce the missing authentication check on the affected interface.

Root Cause

The camera firmware exposes a network-reachable endpoint that returns video analytics events without validating the caller's identity. The authorization decision is absent, so anonymous requests are treated as trusted. This is characteristic of interfaces developed for internal or trusted-network consumption that were later reachable from broader network segments.

Attack Vector

Exploitation requires only network reachability to the camera. An attacker on the same LAN, a compromised VLAN, or any routed path to the device can query the vulnerable endpoint and harvest analytics event data. Cameras exposed to the internet, either directly or through misconfigured port forwarding, face the highest exposure. See the Bosch Security Advisory BOSCH-SA-659648 for interface-level technical details.

No public proof-of-concept exploit code is currently associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-58330

Indicators of Compromise

Unauthenticated HTTP or RTSP-adjacent requests to Bosch camera management interfaces originating from non-administrative hosts
Repeated queries to video analytics or event endpoints from a single external or unexpected internal IP address
Outbound flows from client hosts pulling structured event data from camera IP ranges outside of documented VMS traffic patterns

Detection Strategies

Inventory all Bosch CPP13 and CPP14 cameras and correlate observed firmware versions against the fixed versions listed in BOSCH-SA-659648
Inspect network traffic between camera VLANs and general-purpose user segments for anomalous session-less requests to camera HTTP endpoints
Alert on any device outside of the authorized video management system (VMS) reaching camera analytics APIs

Monitoring Recommendations

Enable and centralize camera and switch logs to identify anonymous or failed-auth request patterns targeting camera IPs
Baseline expected traffic between the VMS and cameras, then flag deviations in source IP, request volume, or destination path
Monitor perimeter firewalls and NAT tables for inbound rules that expose camera management ports to the internet

How to Mitigate CVE-2024-58330

Immediate Actions Required

Apply the firmware updates referenced in Bosch Security Advisory BOSCH-SA-659648 to all CPP13 and CPP14 cameras
Remove any direct internet exposure of camera management interfaces and place cameras on a dedicated, segmented VLAN
Restrict inbound access to camera IPs so that only the authorized VMS servers can reach management and analytics endpoints
Rotate camera administrative credentials after patching to invalidate any credentials that may have been observed during exposure

Patch Information

Bosch has published fixed firmware for affected CPP13 and CPP14 platforms. Consult the Bosch PSIRT advisory BOSCH-SA-659648 for the specific firmware versions that introduce the authentication check, along with model-to-firmware mapping and update procedures.

Workarounds

Place affected cameras behind a firewall or ACL that permits access only from the video management system and authorized administrator workstations
Disable remote access features that are not required for operational use until firmware can be applied
Use a VPN or zero-trust network access solution for any remote administrative connection to cameras rather than exposing management interfaces directly

bash

# Example: restrict access to Bosch camera management to the VMS host only
# Replace 10.10.20.5 with the VMS IP and 10.10.30.0/24 with the camera subnet
iptables -A FORWARD -s 10.10.20.5 -d 10.10.30.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.10.30.0/24 -p tcp --dport 443 -j DROP