// For flags

CVE-2020-6785

Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This also affects Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 and Bosch DIVAR IP all-in-one 7000 with installers and installed BVMS versions prior to BVMS 10.1.1.

Cargar una DLL mediante un Elemento de Ruta de Búsqueda no Controlada en Bosch BVMS y BVMS Viewer en las versiones 10.1.0, 10.0.1, 10.0.0 y 9.0.0 y anteriores, permite a un atacante ejecutar código arbitrario en el sistema de una víctima. Esto afecta tanto al instalador como a la aplicación instalada. Esto también afecta a Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 y Bosch DIVAR IP all-in-one 7000 con instaladores y versiones instaladas de BVMS anteriores a BVMS 10.1.1

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-10 CVE Reserved
  • 2021-03-25 CVE Published
  • 2024-02-28 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-427: Uncontrolled Search Path Element
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
< 9.0
Search vendor "Bosch" for product "Video Management System" and version " < 9.0"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip 7000 R2
Search vendor "Bosch" for product "Divar Ip 7000 R2"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
>= 10.0 < 10.0.2
Search vendor "Bosch" for product "Video Management System" and version " >= 10.0 < 10.0.2"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip 7000 R2
Search vendor "Bosch" for product "Divar Ip 7000 R2"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
>= 10.1 < 10.1.1
Search vendor "Bosch" for product "Video Management System" and version " >= 10.1 < 10.1.1"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip 7000 R2
Search vendor "Bosch" for product "Divar Ip 7000 R2"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
< 9.0
Search vendor "Bosch" for product "Video Management System" and version " < 9.0"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip All-in-one 5000
Search vendor "Bosch" for product "Divar Ip All-in-one 5000"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
>= 10.0 < 10.0.2
Search vendor "Bosch" for product "Video Management System" and version " >= 10.0 < 10.0.2"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip All-in-one 5000
Search vendor "Bosch" for product "Divar Ip All-in-one 5000"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
>= 10.1 < 10.1.1
Search vendor "Bosch" for product "Video Management System" and version " >= 10.1 < 10.1.1"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip All-in-one 5000
Search vendor "Bosch" for product "Divar Ip All-in-one 5000"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
< 9.0
Search vendor "Bosch" for product "Video Management System" and version " < 9.0"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip All-in-one 7000
Search vendor "Bosch" for product "Divar Ip All-in-one 7000"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
>= 10.0 < 10.0.2
Search vendor "Bosch" for product "Video Management System" and version " >= 10.0 < 10.0.2"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip All-in-one 7000
Search vendor "Bosch" for product "Divar Ip All-in-one 7000"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System
Search vendor "Bosch" for product "Video Management System"
>= 10.1 < 10.1.1
Search vendor "Bosch" for product "Video Management System" and version " >= 10.1 < 10.1.1"
-
Affected
in Bosch
Search vendor "Bosch"
Divar Ip All-in-one 7000
Search vendor "Bosch" for product "Divar Ip All-in-one 7000"
--
Safe
Bosch
Search vendor "Bosch"
Video Management System Viewer
Search vendor "Bosch" for product "Video Management System Viewer"
< 9.0
Search vendor "Bosch" for product "Video Management System Viewer" and version " < 9.0"
-
Affected
Bosch
Search vendor "Bosch"
Video Management System Viewer
Search vendor "Bosch" for product "Video Management System Viewer"
>= 10.0 < 10.0.2
Search vendor "Bosch" for product "Video Management System Viewer" and version " >= 10.0 < 10.0.2"
-
Affected
Bosch
Search vendor "Bosch"
Video Management System Viewer
Search vendor "Bosch" for product "Video Management System Viewer"
>= 10.1.0 < 10.1.1
Search vendor "Bosch" for product "Video Management System Viewer" and version " >= 10.1.0 < 10.1.1"
-
Affected