Vulnerability · Published Sep 30, 2022 · Assigned by bosch

CVE-2022-32540

High 7.4

In plain English

A high-severity information exposure in BVMS from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.0)7.4High

Exploit odds (30 days)0.4%top 68.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.

Affected products (as reported)

Vendor	Product	Versions
Bosch	BVMS	11.1 – through 11.1.011.0 – through 11.0.010.1 – through 10.1.1
Bosch	VJD-7513	10.23.000210.30.0005

Weakness: CWE-200 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://psirt.bosch.com/security-advisories/bosch-sa-464066.html x_refsource_CONFIRM