HIGH🇵🇱 Wersja polska

CVE-2021-23862

CVSS 7.2v3.1pub. 2021-12-08upd. 2024-11-21

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000).

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Bosch Video Management System

    APP
    Bosch
    10.111.0≤ 9.010.0 – 10.0.2 (excl.)

  • Bosch Divar Ip 5000 Firmware

    OS
    Bosch
    all versions

  • Bosch Divar Ip 7000 Firmware

    OS
    Bosch
    all versions

  • Bosch Videojet Decoder 7513

    HW
    Bosch
    all versions

  • Bosch Videojet Decoder 7513 Firmware

    OS
    Bosch
    ≤ 10.22.0038

  • Bosch Videojet Decoder 8000

    HW
    Bosch
    all versions

  • Bosch Videojet Decoder 8000 Firmware

    OS
    Bosch
    ≤ 10.01.0036

  • Bosch Video Recording Manager

    APP
    Bosch
    4.0 – 4.00.00703.83 – 3.83.00213.82 – 3.82.0057≤ 3.81
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2021-23859CRITICAL9.1PL ✓same product

Bosch BVMS/VRM — nieuwierzytelniona awaria usługi i obejście autoryzacji

CVE-2019-11684CRITICAL9.9PL ✓same product

Nieprawidłowa kontrola dostępu w serwerze RCP+ komponentu Bosch VRM

CVE-2020-6770CRITICAL10.0PL ✓same product

RCE przez deserializację w Bosch BVMS Mobile Video Service

CVE-2020-6769CRITICAL10.0PL ✓same product

Brak uwierzytelnienia w Bosch Video Streaming Gateway — pełny dostęp zdalny

CVE-2019-6958CRITICAL9.1PL ✓same product

Bosch BVMS i powiązane produkty — brak uwierzytelnienia na porcie RCP+