Vulnerability · Published Dec 8, 2021 · Assigned by bosch
CVE-2021-23862Authenticated Remote Code Execution
High 7.2
In plain English
A high-severity improper input validation in BVMS from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.4%top 26.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch | BVMS | unspecified – through 9.0.011.0 – before 11.0.010.0 – before 10.0.210.1 – before 10.1.1 |
| Bosch | DIVAR IP 7000 R2 | all |
| Bosch | DIVAR IP all-in-one 5000 | all |
| Bosch | DIVAR IP all-in-one 7000 | all |
| Bosch | VRM | unspecified – through 3.814.0 – through 4.00.00703.83 – through 3.83.00213.82 – through 3.82.0057 |
| Bosch | VJD-8000 | unspecified – through 10.01.0036 |
| Bosch | VJD-7513 | unspecified – through 10.22.0038 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html x_refsource_CONFIRM