HIGH🇬🇧 English

CVE-2021-23862

CVSS 7.2v3.1pub. 2021-12-08upd. 2024-11-21

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000).

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Bosch Video Management System

    APP
    Bosch
    10.111.0≤ 9.010.0 – 10.0.2 (bez)

  • Bosch Divar Ip 5000 Firmware

    OS
    Bosch
    wszystkie wersje

  • Bosch Divar Ip 7000 Firmware

    OS
    Bosch
    wszystkie wersje

  • Bosch Videojet Decoder 7513

    HW
    Bosch
    wszystkie wersje

  • Bosch Videojet Decoder 7513 Firmware

    OS
    Bosch
    ≤ 10.22.0038

  • Bosch Videojet Decoder 8000

    HW
    Bosch
    wszystkie wersje

  • Bosch Videojet Decoder 8000 Firmware

    OS
    Bosch
    ≤ 10.01.0036

  • Bosch Video Recording Manager

    APP
    Bosch
    4.0 – 4.00.00703.83 – 3.83.00213.82 – 3.82.0057≤ 3.81
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Command Injection
CWE
Referencje

Powiązane podatności

CVE-2021-23859CRITICAL9.1ten sam produkt

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of...

CVE-2019-11684CRITICAL9.9ten sam produkt

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitra...

CVE-2020-6770CRITICAL10.0ten sam produkt

Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote...

CVE-2020-6769CRITICAL10.0ten sam produkt

Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthentica...

CVE-2019-6958CRITICAL9.1ten sam produkt

A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and...