CVSS: 5.9EPSS: 0%CPEs: 20EXPL: 0CVE-2023-35867
https://notcve.org/view.php?id=CVE-2023-35867
18 Dec 2023 — An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks. Un manejo inadecuado de paquetes de respuesta API con formato incorrecto para clientes API en productos de software Bosch BT puede permitir que un atacante no autenticado provoque una situación de denegación ... • https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html • CWE-703: Improper Check or Handling of Exceptional Conditions •
CVSS: 7.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-32540
https://notcve.org/view.php?id=CVE-2022-32540
30 Sep 2022 — Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x. Una divulgación de información en la aplicación Operator Client en BVMS versiones 10.1.1, 11.0 y 11.1.0 y VIDEOJET Decoder VJD-7513 versiones 10.23 y 10.30, permi... • https://psirt.bosch.com/security-advisories/bosch-sa-464066.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 14EXPL: 0CVE-2021-23862 – Authenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-23862
08 Dec 2021 — A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000). Un paquete de configuración diseñado enviado por un usuario administrativo autenticado puede ser usado para ejecutar comandos arbitrarios en el contexto del sistema. Este problema también afecta a las instalaciones de VRM, DIVAR IP, BVMS con VR... • https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-23861 – Possible Access to Debug Functions in Bosch VRM / BVMS
https://notcve.org/view.php?id=CVE-2021-23861
08 Dec 2021 — By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed. Al ejecutar un comando especial, un usuario con derechos administrativos puede conseguir acceso a la funcionalidad extended debug en el VRM permitiendo un impacto en la integridad o disponibilidad del software instalado. Este pro... • https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html • CWE-489: Active Debug Code •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2021-23860 – Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS
https://notcve.org/view.php?id=CVE-2021-23860
08 Dec 2021 — An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed. Un error en un manejador de páginas del VRM puede conllevar a un ataque de tipo un cross site scripting (XSS) reflejado en la interfaz basada en la web. Para explotar esta vulnerabilidad un ataque debe ser capaz de modi... • https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 15EXPL: 0CVE-2021-23859 – Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products
https://notcve.org/view.php?id=CVE-2021-23859
08 Dec 2021 — An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859 Un atacante no autenticado es capaz de en... • https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html • CWE-703: Improper Check or Handling of Exceptional Conditions CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 10.0EPSS: 0%CPEs: 8EXPL: 0CVE-2020-6770 – Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service
https://notcve.org/view.php?id=CVE-2020-6770
07 Feb 2020 — Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed. Una Deserialización de Datos No Confiables en el BVMS Mobile Video Service (BVMS MVS), permite a un atacante remoto no autenticado ejecutar código ar... • https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 27EXPL: 0CVE-2019-6957 – Buffer Overflow for Bosch Video Systems, PSIM and Access Control Systems
https://notcve.org/view.php?id=CVE-2019-6957
29 May 2019 — A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager (VRM), Video Streaming Gateway (VSG), Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The vulnerability potentially allows the unauthorized execution of code in the system via the network interf... • https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0403bt-cve-2019-6957_security_advisory_software_buffer_overflow.pdf • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2019-6958 – Improper Access Control for Bosch Video Systems, PSIM and Access Control Systems
https://notcve.org/view.php?id=CVE-2019-6958
29 May 2019 — A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The RCP+ network port allows access without authentication. Adding authentication feature to the respective library fixes the issue. The issue is classified as "CWE-284: ... • https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0404bt-cve-2019-6958_security_advisory_improper_access_control.pdf • CWE-306: Missing Authentication for Critical Function •