Log in Start free

Vulnerability · Published Feb 7, 2020 · Assigned by bosch

CVE-2020-6770Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service

Critical 10.0

In plain English

A critical-severity unsafe deserialization in BVMS Mobile Video Service from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)3.6%top 10.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.

Affected products (as reported)

VendorProductVersions
Bosch DIVAR IP 3000 All
Bosch DIVAR IP 7000 All
Bosch BVMS Mobile Video Service unspecified – through 8.0.0.329unspecified – through 9.0.0.827unspecified – through 10.0.0.1225unspecified – through 7.5

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References