Vulnerability · Published Jun 15, 2023 · Assigned by bosch
CVE-2023-28175
High 7.1
In plain English
A high-severity information exposure in Bosch DIVAR IP 3000 from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch | BVMS | 7.5 – through 11.1.1 |
| Bosch | BVMS Viewer | 7.5 – through 11.1.1 |
| Bosch | Bosch DIVAR IP 3000 | 7.5 – through 8.0 |
| Bosch | Bosch DIVAR IP 7000 R1 | 7.5 – through 8.0 |
| Bosch | Bosch DIVAR IP 7000 R2 | 7.5 – through 11.1.1 |
| Bosch | Bosch DIVAR IP all-in-one 7000 R3 | 10.1.1 – through 11.1.1 |
| Bosch | Bosch DIVAR IP all-in-one 5000 | 9.0 – through 11.1.1 |
| Bosch | Bosch DIVAR IP all-in-one 7000 | 9.0 – through 11.1.1 |
| Bosch | DIVAR IP all-in-one 4000 | 11.1.1 |
| Bosch | DIVAR IP all-in-one 6000 | 11.1.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N