Vulnerability · Published Dec 8, 2021 · Assigned by bosch
CVE-2021-23861Possible Access to Debug Functions in Bosch VRM / BVMS
Medium 6.5
In plain English
A medium-severity security flaw in BVMS from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 42.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch | BVMS | unspecified – through 9.0.011.0 – before 11.0.010.0 – before 10.0.210.1 – before 10.1.1 |
| Bosch | DIVAR IP 7000 R2 | all |
| Bosch | DIVAR IP all-in-one 5000 | all |
| Bosch | DIVAR IP all-in-one 7000 | all |
| Bosch | VRM | unspecified – through 3.814.0 – through 4.00.00703.83 – through 3.83.00213.82 – through 3.82.0057 |
Weakness: CWE-489 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
References
- https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html x_refsource_CONFIRM