CRITICAL🇵🇱 Wersja polska

CVE-2019-11684

CVSS 9.9v3.1pub. 2021-02-26upd. 2024-11-21

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

  • Bosch Divar Ip 5000

    HW
    Bosch
    all versions

  • Bosch Divar Ip 5000 Firmware

    OS
    Bosch
    3.80 – 3.80.0039 (excl.)

  • Bosch Video Management System

    APP
    Bosch
    3.70.00563.70.00583.70.00603.70.00623.71.00223.71.00293.71.00313.71.00323.81.00323.81.00383.81.0048

  • Bosch Video Recording Manager

    APP
    Bosch
    3.81 – 3.81.0050 (excl.)3.70 – 3.71.0034 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-23859CRITICAL9.1PL ✓same product

Bosch BVMS/VRM — nieuwierzytelniona awaria usługi i obejście autoryzacji

CVE-2020-6769CRITICAL10.0PL ✓same product

Brak uwierzytelnienia w Bosch Video Streaming Gateway — pełny dostęp zdalny

CVE-2019-6957CRITICAL9.8PL ✓same product

Przepełnienie buforu w produktach Bosch Video/Access — zdalne wykonanie kodu

CVE-2023-32230HIGH7.5same product

An improper handling of a malformed API request to an API server in Bosch BT software products can allow an un...

CVE-2023-28175HIGH7.1same product

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user ...