CVE-2018-12638

PoC ×2—

CVSS 3.0

6.1 medium

EPSS

1%p63

Published

Mar 21, 2019 (Mar 21, 2019)

Modified

Jun 17, 2026

Description

An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app.

Vendors: bose
Products: soundtouch
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.