Log in Start free

Vulnerability · Published Mar 25, 2021 · Assigned by bosch

CVE-2020-6785Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer

High 7.8

In plain English

A high-severity uncontrolled search path in BVMS from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 72.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This also affects Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 and Bosch DIVAR IP all-in-one 7000 with installers and installed BVMS versions prior to BVMS 10.1.1.

Affected products (as reported)

VendorProductVersions
Bosch BVMS unspecified – before 9.0.010.0 – before 10.0.210.1 – before 10.1.1
Bosch BVMS Viewer unspecified – before 9.0.010.0 – before 10.0.210.1 – before 10.1.1
Bosch DIVAR IP 7000 R2 all
Bosch DIVAR IP all-in-one 5000 all
Bosch DIVAR IP all-in-one 7000 all

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References