Search criteria
12 vulnerabilities found for DIVAR IP 3000 by Bosch
VAR-202306-1304
Vulnerability from variot - Updated: 2023-12-24 22:50Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request. Bosch Video Management System (BVMS) , Bosch BVMS Viewer , divar ip 3000 firmware etc. Robert Bosch GmbH The product contains an incorrect authentication vulnerability.Information may be obtained
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202306-1304",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "divar ip 7000 r3",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "11.1.1"
},
{
"model": "video management system viewer",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "divar ip 6000",
"scope": "eq",
"trust": 1.0,
"vendor": "bosch",
"version": "11.1.1"
},
{
"model": "divar ip 5000",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0"
},
{
"model": "divar ip 4000",
"scope": "eq",
"trust": 1.0,
"vendor": "bosch",
"version": "11.1.1"
},
{
"model": "divar ip 5000",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "11.1.1"
},
{
"model": "divar ip 3000",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0"
},
{
"model": "divar ip 7000 r3",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.1.1"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "11.1.1"
},
{
"model": "video management system",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "divar ip 3000",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "divar ip 7000 r2",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "divar ip 7000",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0"
},
{
"model": "divar ip 7000",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "divar ip 7000 r2",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "11.1.1"
},
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "11.1.1"
},
{
"model": "video management system",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 7000",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 6000",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "bvms viewer",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 4000",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 3000",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 7000 r3",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 7000 r2",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 5000",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"db": "NVD",
"id": "CVE-2023-28175"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.1.1",
"versionStartIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.1.1",
"versionStartIncluding": "7.5",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_4000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_5000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_6000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000_r3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_3000_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0",
"versionStartIncluding": "7.5",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_6000_firmware:11.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_6000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_4000_firmware:11.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_4000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_5000_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.1.1",
"versionStartIncluding": "9.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_5000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_7000_r2_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.1.1",
"versionStartIncluding": "7.5",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_7000_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0",
"versionStartIncluding": "7.5",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_7000_r3_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.1.1",
"versionStartIncluding": "10.1.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000_r3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-28175"
}
]
},
"cve": "CVE-2023-28175",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.1,
"impactScore": 4.0,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "psirt@bosch.com",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 4.7,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.7,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-28175",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2023-28175",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "psirt@bosch.com",
"id": "CVE-2023-28175",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202306-1186",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request. Bosch Video Management System (BVMS) , Bosch BVMS Viewer , divar ip 3000 firmware etc. Robert Bosch GmbH The product contains an incorrect authentication vulnerability.Information may be obtained",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"db": "VULMON",
"id": "CVE-2023-28175"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-28175",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2023-014290",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1186",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-28175",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-28175"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
]
},
"id": "VAR-202306-1304",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.45833334
},
"last_update_date": "2023-12-24T22:50:52.738000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Bosch Video Management System Security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=244463"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-863",
"trust": 1.0
},
{
"problemtype": "Illegal authentication (CWE-863) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"db": "NVD",
"id": "CVE-2023-28175"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-025794-bt.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-28175"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-28175/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-28175"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-28175"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2023-28175"
},
{
"date": "2023-12-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"date": "2023-06-15T11:15:09.227000",
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"date": "2023-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2023-28175"
},
{
"date": "2023-12-22T08:15:00",
"db": "JVNDB",
"id": "JVNDB-2023-014290"
},
{
"date": "2023-07-05T13:25:06.167000",
"db": "NVD",
"id": "CVE-2023-28175"
},
{
"date": "2023-07-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0Robert\u00a0Bosch\u00a0GmbH\u00a0 Fraudulent Authentication Vulnerability in Products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-014290"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-1186"
}
],
"trust": 0.6
}
}
VAR-202002-1207
Vulnerability from variot - Updated: 2023-12-18 13:56A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed. plural Bosch The product contains a past traversal vulnerability.Information may be obtained. Bosch DIVAR IP 3000 is a 3000 series video recorder from the German company Bosch (Bosch). The vulnerability stems from a network system or product failing to properly filter resources or special elements in the file path. An attacker can use this vulnerability to access a location outside the restricted directory
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202002-1207",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0.0.1225"
},
{
"model": "video management system viewer",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "video management system viewer",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0"
},
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0.0.329"
},
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0.0.827"
},
{
"model": "video management system",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0.0.1225"
},
{
"model": "video management system viewer",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0.329"
},
{
"model": "video management system",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0"
},
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0.0.827"
},
{
"model": "video management system",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0"
},
{
"model": "bvms viewer",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "video recording manager",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": "3000"
},
{
"model": "bvms",
"scope": "gte",
"trust": 0.6,
"vendor": "bosch",
"version": "10.0,\u003c=10.0.0.1225"
},
{
"model": "bvms",
"scope": "gte",
"trust": 0.6,
"vendor": "bosch",
"version": "9.0,\u003c=9.0.0.827"
},
{
"model": "bvms",
"scope": "gte",
"trust": 0.6,
"vendor": "bosch",
"version": "8.0,\u003c=8.0.329"
},
{
"model": "bvms",
"scope": "lte",
"trust": 0.6,
"vendor": "bosch",
"version": "\u003c=7.5"
},
{
"model": "bvms viewer",
"scope": "gte",
"trust": 0.6,
"vendor": "bosch",
"version": "10.0,\u003c=10.0.0.1225"
},
{
"model": "bvms viewer",
"scope": "gte",
"trust": 0.6,
"vendor": "bosch",
"version": "9.0,\u003c=9.0.0.827"
},
{
"model": "bvms viewer",
"scope": "gte",
"trust": 0.6,
"vendor": "bosch",
"version": "8.0,\u003c=8.0.329"
},
{
"model": "bvms viewer",
"scope": "lte",
"trust": 0.6,
"vendor": "bosch",
"version": "\u003c=7.5"
},
{
"model": "divar ip",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": "7000"
},
{
"model": "divar ip all-in-one",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": "5000"
},
{
"model": "divar ip 3000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
},
{
"model": "divar ip all-in-one 5000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
},
{
"model": "divar ip 7000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-6767"
}
]
},
"cve": "CVE-2020-6767",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-001980",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CNVD-2020-18524",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULMON",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2020-6767",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "psirt@bosch.com",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.1,
"impactScore": 4.0,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-001980",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-6767",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "psirt@bosch.com",
"id": "CVE-2020-6767",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-001980",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2020-18524",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202002-173",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-6767",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "VULMON",
"id": "CVE-2020-6767"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed. plural Bosch The product contains a past traversal vulnerability.Information may be obtained. Bosch DIVAR IP 3000 is a 3000 series video recorder from the German company Bosch (Bosch). The vulnerability stems from a network system or product failing to properly filter resources or special elements in the file path. An attacker can use this vulnerability to access a location outside the restricted directory",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "VULMON",
"id": "CVE-2020-6767"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-6767",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-18524",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2020-6767",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "VULMON",
"id": "CVE-2020-6767"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"id": "VAR-202002-1207",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
}
],
"trust": 1.464583335
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
}
]
},
"last_update_date": "2023-12-18T13:56:22.303000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BOSCH-SA-381489-BT",
"trust": 0.8,
"url": "https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-sa-381489-bt_cve-2020-6767_securityadvisory_bvms_pathtraversal.pdf"
},
{
"title": "Patch for Bosch Video Management System path traversal vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/209977"
},
{
"title": "Bosch Video Management System Repair measures for path traversal vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=109374"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "NVD",
"id": "CVE-2020-6767"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-6767"
},
{
"trust": 1.7,
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-381489-bt.html"
},
{
"trust": 1.7,
"url": "https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-sa-381489-bt_cve-2020-6767_securityadvisory_bvms_pathtraversal.pdf"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6767"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "VULMON",
"id": "CVE-2020-6767"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "VULMON",
"id": "CVE-2020-6767"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-03-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"date": "2020-02-06T00:00:00",
"db": "VULMON",
"id": "CVE-2020-6767"
},
{
"date": "2020-03-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"date": "2020-02-06T17:15:14.130000",
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"date": "2020-02-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-03-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"date": "2020-02-14T00:00:00",
"db": "VULMON",
"id": "CVE-2020-6767"
},
{
"date": "2020-03-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-001980"
},
{
"date": "2020-02-14T18:05:28.613000",
"db": "NVD",
"id": "CVE-2020-6767"
},
{
"date": "2020-02-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Bosch Video Management System path traversal vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-18524"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202002-173"
}
],
"trust": 0.6
}
}
VAR-202002-1209
Vulnerability from variot - Updated: 2023-12-18 13:52Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 <= 6.45.08, 6.44 <= 6.44.022, 6.43 <= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 <= 3.62.0019 and DIVAR IP 5000 <= 3.80.0039 if the corresponding port 8023 has been opened in the device's firewall. plural Bosch The product contains vulnerabilities related to lack of authentication for critical features.Information is obtained and service operation is interrupted (DoS) It may be put into a state. Bosch DIVAR IP 2000 is a 2000 series video recorder. Bosch DIVAR IP 3000 is a 3000 series video recorder
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202002-1209",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "video streaming gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "6.45"
},
{
"model": "video streaming gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "6.45.08"
},
{
"model": "divar ip 5000",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "3.80.0039"
},
{
"model": "video streaming gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "6.43"
},
{
"model": "video streaming gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "6.42.10"
},
{
"model": "divar ip 2000",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "3.62.0019"
},
{
"model": "video streaming gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "6.44"
},
{
"model": "video streaming gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "6.44.022"
},
{
"model": "video streaming gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "6.43.0023"
},
{
"model": "divar ip 2000",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 5000",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "video streaming gateway",
"scope": null,
"trust": 0.8,
"vendor": "robert bosch",
"version": null
},
{
"model": "divar ip 7000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
},
{
"model": "video streaming gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": "6.45.0008"
},
{
"model": "video streaming gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": "6.43.0023"
},
{
"model": "divar ip 5000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
},
{
"model": "divar ip 3000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
},
{
"model": "divar ip 2000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.42.10",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.43.0023",
"versionStartIncluding": "6.43",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.44.022",
"versionStartIncluding": "6.44",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.45.08",
"versionStartIncluding": "6.45",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_2000_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.62.0019",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_2000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:bosch:divar_ip_5000_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.80.0039",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_5000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.42.10",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.43.0023",
"versionStartIncluding": "6.43",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.44.022",
"versionStartIncluding": "6.44",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.45.08",
"versionStartIncluding": "6.45",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.42.10",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.43.0023",
"versionStartIncluding": "6.43",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.44.022",
"versionStartIncluding": "6.44",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.45.08",
"versionStartIncluding": "6.45",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.42.10",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.43.0023",
"versionStartIncluding": "6.43",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.44.022",
"versionStartIncluding": "6.44",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_streaming_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.45.08",
"versionStartIncluding": "6.45",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-6769"
}
]
},
"cve": "CVE-2020-6769",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.4,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-001873",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-184894",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "psirt@bosch.com",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.1,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-001873",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-6769",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "psirt@bosch.com",
"id": "CVE-2020-6769",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "JVNDB-2020-001873",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202002-241",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-184894",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-184894"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 \u003c= 6.45.08, 6.44 \u003c= 6.44.022, 6.43 \u003c= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 \u003c= 3.62.0019 and DIVAR IP 5000 \u003c= 3.80.0039 if the corresponding port 8023 has been opened in the device\u0027s firewall. plural Bosch The product contains vulnerabilities related to lack of authentication for critical features.Information is obtained and service operation is interrupted (DoS) It may be put into a state. Bosch DIVAR IP 2000 is a 2000 series video recorder. Bosch DIVAR IP 3000 is a 3000 series video recorder",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "VULHUB",
"id": "VHN-184894"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-6769",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001873",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202002-241",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-184894",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-184894"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"id": "VAR-202002-1209",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-184894"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:52:02.655000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BOSCH-SA-260625-BT",
"trust": 0.8,
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-260625-bt.html"
},
{
"title": "Bosch Video Streaming Gateway Fixes for access control error vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=110471"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-184894"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "NVD",
"id": "CVE-2020-6769"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-260625-bt.html"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-6769"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6769"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-184894"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-184894"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-02-07T00:00:00",
"db": "VULHUB",
"id": "VHN-184894"
},
{
"date": "2020-02-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"date": "2020-02-07T20:15:35.507000",
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"date": "2020-02-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-02-12T00:00:00",
"db": "VULHUB",
"id": "VHN-184894"
},
{
"date": "2020-02-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-001873"
},
{
"date": "2020-02-12T23:41:53.637000",
"db": "NVD",
"id": "CVE-2020-6769"
},
{
"date": "2020-03-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Bosch Vulnerability regarding lack of authentication for critical features in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-001873"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "access control error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202002-241"
}
],
"trust": 0.6
}
}
VAR-202002-1208
Vulnerability from variot - Updated: 2023-12-18 13:13A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed. plural Bosch The product contains a past traversal vulnerability.Information may be obtained. Bosch DIVAR IP 3000 is a 3000 series video recorder of Germany Bosch.
Bosch DIVAR IP 3000 has a path traversal vulnerability
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202002-1208",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0.0.1225"
},
{
"model": "video management system viewer",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "video management system viewer",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0"
},
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0.0.329"
},
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0.0.827"
},
{
"model": "video management system",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0.0.1225"
},
{
"model": "video management system viewer",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0.329"
},
{
"model": "video management system",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "10.0"
},
{
"model": "video management system",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "7.5"
},
{
"model": "video management system viewer",
"scope": "lte",
"trust": 1.0,
"vendor": "bosch",
"version": "9.0.0.827"
},
{
"model": "video management system",
"scope": "gte",
"trust": 1.0,
"vendor": "bosch",
"version": "8.0"
},
{
"model": "bvms viewer",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "10.0 \u304b\u3089 10.0.0.1225"
},
{
"model": "bvms viewer",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "7.5"
},
{
"model": "bvms viewer",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "8.0 \u304b\u3089 8.0.0.329"
},
{
"model": "bvms viewer",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "9.0 \u304b\u3089 9.0.0.827"
},
{
"model": "video management system",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "10.0 \u304b\u3089 10.0.0.1225"
},
{
"model": "video management system",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "7.5"
},
{
"model": "video management system",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "8.0 \u304b\u3089 8.0.0.329"
},
{
"model": "video management system",
"scope": "eq",
"trust": 0.8,
"vendor": "robert bosch",
"version": "9.0 \u304b\u3089 9.0.0.827"
},
{
"model": "divar ip",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": "3000"
},
{
"model": "divar ip 3000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
},
{
"model": "divar ip all-in-one 5000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
},
{
"model": "divar ip 7000",
"scope": "eq",
"trust": 0.6,
"vendor": "bosch",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_7000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.0.329",
"versionStartIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.827",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.0.0.1225",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-6768"
}
]
},
"cve": "CVE-2020-6768",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-001869",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2020-04548",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "psirt@bosch.com",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-001869",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-6768",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "psirt@bosch.com",
"id": "CVE-2020-6768",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-001869",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2020-04548",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202002-234",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed. plural Bosch The product contains a past traversal vulnerability.Information may be obtained. Bosch DIVAR IP 3000 is a 3000 series video recorder of Germany Bosch. \n\r\n\r\nBosch DIVAR IP 3000 has a path traversal vulnerability",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "CNVD",
"id": "CNVD-2020-04548"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-6768",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-04548",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202002-234",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"id": "VAR-202002-1208",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
}
],
"trust": 1.32916667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
}
]
},
"last_update_date": "2023-12-18T13:13:04.006000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BOSCH-SA-815013-BT",
"trust": 0.8,
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
},
{
"title": "Patch for Bosch DIVAR IP 3000 Path Traversal Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/199903"
},
{
"title": "Multiple Bosch Product path traversal vulnerability fixes",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=110469"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "NVD",
"id": "CVE-2020-6768"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-6768"
},
{
"trust": 1.6,
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6768"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-02-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"date": "2020-02-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"date": "2020-02-07T21:15:10.653000",
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"date": "2020-02-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-02-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-04548"
},
{
"date": "2020-02-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-001869"
},
{
"date": "2020-02-12T19:43:52.900000",
"db": "NVD",
"id": "CVE-2020-6768"
},
{
"date": "2020-03-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Bosch Product path traversal vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-001869"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202002-234"
}
],
"trust": 0.6
}
}
CVE-2020-6770 (GCVE-0-2020-6770)
Vulnerability from cvelistv5 – Published: 2020-02-07 20:08 – Updated: 2024-09-17 04:09
VLAI?
Summary
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.
Severity ?
10 (Critical)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 3000 |
Affected:
All
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:04.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "BVMS Mobile Video Service",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.0.0.329",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.0.827",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.0.1225",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-07T20:08:31",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html"
}
],
"source": {
"advisory": "BOSCH-SA-885551-BT",
"discovery": "INTERNAL"
},
"title": "Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6770",
"STATE": "PUBLIC",
"TITLE": "Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS MVS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
}
]
},
"vendor_name": "Bosch"
},
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS MVS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
}
]
},
"vendor_name": "Bosch"
},
{
"product": {
"product_data": [
{
"product_name": "BVMS Mobile Video Service",
"version": {
"version_data": [
{
"configuration": "patch for security issue 243748 not installed",
"version_affected": "\u003c=",
"version_value": "8.0.0.329"
},
{
"configuration": "patch for security issue 243748 not installed",
"version_affected": "\u003c=",
"version_value": "9.0.0.827"
},
{
"configuration": "patch for security issue 243748 not installed",
"version_affected": "\u003c=",
"version_value": "10.0.0.1225"
},
{
"version_affected": "\u003c=",
"version_value": "7.5"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502 Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-885551-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6770",
"datePublished": "2020-02-07T20:08:31.437569Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-17T04:09:12.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6768 (GCVE-0-2020-6768)
Vulnerability from cvelistv5 – Published: 2020-02-07 20:01 – Updated: 2024-09-17 00:16
VLAI?
Summary
A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
Severity ?
8.6 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 3000 |
Affected:
All
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:05.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "Bosch Video Management System",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.0.329",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.0.827",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.0.1225",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "BVMS Viewer",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.0.329",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.0.827",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.0.1225",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-07T20:01:21",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-815013-BT",
"discovery": "INTERNAL"
},
"title": "Path Traversal in Bosch Video Management System (BVMS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6768",
"STATE": "PUBLIC",
"TITLE": "Path Traversal in Bosch Video Management System (BVMS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP all-in-one 5000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "Bosch Video Management System",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.5"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "8.0.0.329"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "9.0.0.827"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "10.0.0.1225"
}
]
}
},
{
"product_name": "BVMS Viewer",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.5"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "8.0.0.329"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "9.0.0.827"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "10.0.0.1225"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-815013-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6768",
"datePublished": "2020-02-07T20:01:21.945283Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-17T00:16:27.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6769 (GCVE-0-2020-6769)
Vulnerability from cvelistv5 – Published: 2020-02-07 19:57 – Updated: 2024-09-16 21:03
VLAI?
Summary
Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 <= 6.45.08, 6.44 <= 6.44.022, 6.43 <= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 <= 3.62.0019 and DIVAR IP 5000 <= 3.80.0039 if the corresponding port 8023 has been opened in the device's firewall.
Severity ?
10 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 2000 |
Affected:
unspecified , ≤ 3.62.0019
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:04.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 2000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "3.62.0019",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP 5000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "3.80.0039",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Video Streaming Gateway",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "6.45.08",
"status": "affected",
"version": "6.45",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.44.0030",
"status": "affected",
"version": "6.44",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.43.0023",
"status": "affected",
"version": "6.43",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.42.10",
"status": "affected",
"version": "6.42 and older",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 \u003c= 6.45.08, 6.44 \u003c= 6.44.022, 6.43 \u003c= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 \u003c= 3.62.0019 and DIVAR IP 5000 \u003c= 3.80.0039 if the corresponding port 8023 has been opened in the device\u0027s firewall."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-07T19:57:12",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html"
}
],
"source": {
"advisory": "BOSCH-SA-260625-BT",
"discovery": "INTERNAL"
},
"title": "Missing Authentication for Critical Function in Bosch Video Streaming Gateway",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6769",
"STATE": "PUBLIC",
"TITLE": "Missing Authentication for Critical Function in Bosch Video Streaming Gateway"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 2000",
"version": {
"version_data": [
{
"configuration": "port 8023 on device\u0027s firewall opened explicitly and vulnerable VSG version installed",
"version_affected": "\u003c=",
"version_value": "3.62.0019"
}
]
}
},
{
"product_name": "DIVAR IP 5000",
"version": {
"version_data": [
{
"configuration": "port 8023 on device\u0027s firewall opened explicitly and vulnerable VSG version installed",
"version_affected": "\u003c=",
"version_value": "3.80.0039"
}
]
}
},
{
"product_name": "Video Streaming Gateway",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "6.45",
"version_value": "6.45.08"
},
{
"version_affected": "\u003c=",
"version_name": "6.44",
"version_value": "6.44.0030"
},
{
"version_affected": "\u003c=",
"version_name": "6.43",
"version_value": "6.43.0023"
},
{
"version_affected": "\u003c=",
"version_name": "6.42 and older",
"version_value": "6.42.10"
}
]
}
},
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"configuration": "vulnerable VSG version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"configuration": "vulnerable VSG version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP all-in-one 5000",
"version": {
"version_data": [
{
"configuration": "vulnerable VSG version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 \u003c= 6.45.08, 6.44 \u003c= 6.44.022, 6.43 \u003c= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 \u003c= 3.62.0019 and DIVAR IP 5000 \u003c= 3.80.0039 if the corresponding port 8023 has been opened in the device\u0027s firewall."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-306 Missing Authentication for Critical Function"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-260625-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6769",
"datePublished": "2020-02-07T19:57:12.914579Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-16T21:03:26.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6767 (GCVE-0-2020-6767)
Vulnerability from cvelistv5 – Published: 2020-02-06 16:19 – Updated: 2024-09-16 18:14
VLAI?
Summary
A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
Severity ?
7.7 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 3000 |
Affected:
All
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:04.890Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "Bosch Video Management System",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.0 and older"
},
{
"status": "affected",
"version": "7.5 and older"
},
{
"status": "affected",
"version": "8.0 through 8.0.0.329"
},
{
"status": "affected",
"version": "9.0 through 9.0.0.827"
},
{
"status": "affected",
"version": "10.0 through 10.0.0.1225"
}
]
},
{
"product": "BVMS Viewer",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.0 and older"
},
{
"status": "affected",
"version": "7.5 and older"
},
{
"status": "affected",
"version": "8.0 through 8.0.0.329"
},
{
"status": "affected",
"version": "9.0 through 9.0.0.827"
},
{
"status": "affected",
"version": "10.0 through 10.0.0.1225"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-06T16:19:51",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html"
}
],
"source": {
"advisory": "BOSCH-SA-381489-BT",
"discovery": "INTERNAL"
},
"title": "Path Traversal in Bosch Video Management System (BVMS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6767",
"STATE": "PUBLIC",
"TITLE": "Path Traversal in Bosch Video Management System (BVMS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP all-in-one 5000",
"version": {
"version_data": [
{
"version_value": "All"
}
]
}
},
{
"product_name": "Bosch Video Management System",
"version": {
"version_data": [
{
"version_value": "7.0 and older"
},
{
"version_value": "7.5 and older"
},
{
"version_value": "8.0 through 8.0.0.329"
},
{
"version_value": "9.0 through 9.0.0.827"
},
{
"version_value": "10.0 through 10.0.0.1225"
}
]
}
},
{
"product_name": "BVMS Viewer",
"version": {
"version_data": [
{
"version_value": "7.0 and older"
},
{
"version_value": "7.5 and older"
},
{
"version_value": "8.0 through 8.0.0.329"
},
{
"version_value": "9.0 through 9.0.0.827"
},
{
"version_value": "10.0 through 10.0.0.1225"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-381489-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6767",
"datePublished": "2020-02-06T16:19:52.006333Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-16T18:14:14.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6770 (GCVE-0-2020-6770)
Vulnerability from nvd – Published: 2020-02-07 20:08 – Updated: 2024-09-17 04:09
VLAI?
Summary
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.
Severity ?
10 (Critical)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 3000 |
Affected:
All
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:04.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "BVMS Mobile Video Service",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.0.0.329",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.0.827",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.0.1225",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-07T20:08:31",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html"
}
],
"source": {
"advisory": "BOSCH-SA-885551-BT",
"discovery": "INTERNAL"
},
"title": "Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6770",
"STATE": "PUBLIC",
"TITLE": "Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS MVS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
}
]
},
"vendor_name": "Bosch"
},
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS MVS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
}
]
},
"vendor_name": "Bosch"
},
{
"product": {
"product_data": [
{
"product_name": "BVMS Mobile Video Service",
"version": {
"version_data": [
{
"configuration": "patch for security issue 243748 not installed",
"version_affected": "\u003c=",
"version_value": "8.0.0.329"
},
{
"configuration": "patch for security issue 243748 not installed",
"version_affected": "\u003c=",
"version_value": "9.0.0.827"
},
{
"configuration": "patch for security issue 243748 not installed",
"version_affected": "\u003c=",
"version_value": "10.0.0.1225"
},
{
"version_affected": "\u003c=",
"version_value": "7.5"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502 Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-885551-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6770",
"datePublished": "2020-02-07T20:08:31.437569Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-17T04:09:12.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6768 (GCVE-0-2020-6768)
Vulnerability from nvd – Published: 2020-02-07 20:01 – Updated: 2024-09-17 00:16
VLAI?
Summary
A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
Severity ?
8.6 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 3000 |
Affected:
All
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:05.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "Bosch Video Management System",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.0.329",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.0.827",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.0.1225",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "BVMS Viewer",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.0.329",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.0.827",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.0.0.1225",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-07T20:01:21",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
}
],
"source": {
"advisory": "BOSCH-SA-815013-BT",
"discovery": "INTERNAL"
},
"title": "Path Traversal in Bosch Video Management System (BVMS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6768",
"STATE": "PUBLIC",
"TITLE": "Path Traversal in Bosch Video Management System (BVMS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP all-in-one 5000",
"version": {
"version_data": [
{
"configuration": "vulnerable BVMS version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "Bosch Video Management System",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.5"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "8.0.0.329"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "9.0.0.827"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "10.0.0.1225"
}
]
}
},
{
"product_name": "BVMS Viewer",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.5"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "8.0.0.329"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "9.0.0.827"
},
{
"configuration": "patch for security issue 211404, 241463 not installed",
"version_affected": "\u003c=",
"version_value": "10.0.0.1225"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-815013-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6768",
"datePublished": "2020-02-07T20:01:21.945283Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-17T00:16:27.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6769 (GCVE-0-2020-6769)
Vulnerability from nvd – Published: 2020-02-07 19:57 – Updated: 2024-09-16 21:03
VLAI?
Summary
Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 <= 6.45.08, 6.44 <= 6.44.022, 6.43 <= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 <= 3.62.0019 and DIVAR IP 5000 <= 3.80.0039 if the corresponding port 8023 has been opened in the device's firewall.
Severity ?
10 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 2000 |
Affected:
unspecified , ≤ 3.62.0019
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:04.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 2000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "3.62.0019",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP 5000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "3.80.0039",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Video Streaming Gateway",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "6.45.08",
"status": "affected",
"version": "6.45",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.44.0030",
"status": "affected",
"version": "6.44",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.43.0023",
"status": "affected",
"version": "6.43",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.42.10",
"status": "affected",
"version": "6.42 and older",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 \u003c= 6.45.08, 6.44 \u003c= 6.44.022, 6.43 \u003c= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 \u003c= 3.62.0019 and DIVAR IP 5000 \u003c= 3.80.0039 if the corresponding port 8023 has been opened in the device\u0027s firewall."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-07T19:57:12",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html"
}
],
"source": {
"advisory": "BOSCH-SA-260625-BT",
"discovery": "INTERNAL"
},
"title": "Missing Authentication for Critical Function in Bosch Video Streaming Gateway",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6769",
"STATE": "PUBLIC",
"TITLE": "Missing Authentication for Critical Function in Bosch Video Streaming Gateway"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 2000",
"version": {
"version_data": [
{
"configuration": "port 8023 on device\u0027s firewall opened explicitly and vulnerable VSG version installed",
"version_affected": "\u003c=",
"version_value": "3.62.0019"
}
]
}
},
{
"product_name": "DIVAR IP 5000",
"version": {
"version_data": [
{
"configuration": "port 8023 on device\u0027s firewall opened explicitly and vulnerable VSG version installed",
"version_affected": "\u003c=",
"version_value": "3.80.0039"
}
]
}
},
{
"product_name": "Video Streaming Gateway",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "6.45",
"version_value": "6.45.08"
},
{
"version_affected": "\u003c=",
"version_name": "6.44",
"version_value": "6.44.0030"
},
{
"version_affected": "\u003c=",
"version_name": "6.43",
"version_value": "6.43.0023"
},
{
"version_affected": "\u003c=",
"version_name": "6.42 and older",
"version_value": "6.42.10"
}
]
}
},
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"configuration": "vulnerable VSG version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"configuration": "vulnerable VSG version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP all-in-one 5000",
"version": {
"version_data": [
{
"configuration": "vulnerable VSG version installed",
"version_affected": "=",
"version_value": "All"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 \u003c= 6.45.08, 6.44 \u003c= 6.44.022, 6.43 \u003c= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 \u003c= 3.62.0019 and DIVAR IP 5000 \u003c= 3.80.0039 if the corresponding port 8023 has been opened in the device\u0027s firewall."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-306 Missing Authentication for Critical Function"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-260625-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6769",
"datePublished": "2020-02-07T19:57:12.914579Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-16T21:03:26.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6767 (GCVE-0-2020-6767)
Vulnerability from nvd – Published: 2020-02-06 16:19 – Updated: 2024-09-16 18:14
VLAI?
Summary
A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
Severity ?
7.7 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bosch | DIVAR IP 3000 |
Affected:
All
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:11:04.890Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP 7000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"product": "Bosch Video Management System",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.0 and older"
},
{
"status": "affected",
"version": "7.5 and older"
},
{
"status": "affected",
"version": "8.0 through 8.0.0.329"
},
{
"status": "affected",
"version": "9.0 through 9.0.0.827"
},
{
"status": "affected",
"version": "10.0 through 10.0.0.1225"
}
]
},
{
"product": "BVMS Viewer",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "7.0 and older"
},
{
"status": "affected",
"version": "7.5 and older"
},
{
"status": "affected",
"version": "8.0 through 8.0.0.329"
},
{
"status": "affected",
"version": "9.0 through 9.0.0.827"
},
{
"status": "affected",
"version": "10.0 through 10.0.0.1225"
}
]
}
],
"datePublic": "2020-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-06T16:19:51",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html"
}
],
"source": {
"advisory": "BOSCH-SA-381489-BT",
"discovery": "INTERNAL"
},
"title": "Path Traversal in Bosch Video Management System (BVMS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@bosch.com",
"DATE_PUBLIC": "2020-01-29T13:00:00.000Z",
"ID": "CVE-2020-6767",
"STATE": "PUBLIC",
"TITLE": "Path Traversal in Bosch Video Management System (BVMS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIVAR IP 3000",
"version": {
"version_data": [
{
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP 7000",
"version": {
"version_data": [
{
"version_value": "All"
}
]
}
},
{
"product_name": "DIVAR IP all-in-one 5000",
"version": {
"version_data": [
{
"version_value": "All"
}
]
}
},
{
"product_name": "Bosch Video Management System",
"version": {
"version_data": [
{
"version_value": "7.0 and older"
},
{
"version_value": "7.5 and older"
},
{
"version_value": "8.0 through 8.0.0.329"
},
{
"version_value": "9.0 through 9.0.0.827"
},
{
"version_value": "10.0 through 10.0.0.1225"
}
]
}
},
{
"product_name": "BVMS Viewer",
"version": {
"version_data": [
{
"version_value": "7.0 and older"
},
{
"version_value": "7.5 and older"
},
{
"version_value": "8.0 through 8.0.0.329"
},
{
"version_value": "9.0 through 9.0.0.827"
},
{
"version_value": "10.0 through 10.0.0.1225"
}
]
}
}
]
},
"vendor_name": "Bosch"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 \u003c= 10.0.0.1225, 9.0 \u003c= 9.0.0.827, 8.0 \u003c= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html",
"refsource": "CONFIRM",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html"
}
]
},
"source": {
"advisory": "BOSCH-SA-381489-BT",
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2020-6767",
"datePublished": "2020-02-06T16:19:52.006333Z",
"dateReserved": "2020-01-10T00:00:00",
"dateUpdated": "2024-09-16T18:14:14.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}