Vulnerability · Published Dec 18, 2023 · Assigned by bosch
CVE-2023-35867
Medium 5.9
In plain English
A medium-severity security flaw in BIS Video Engine from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 53.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch | BVMS | 0 – through 12.0.0 |
| Bosch | BVMS Viewer | 0 – through 12.0.0 |
| Bosch | Configuration Manager | 0 – through 7.62 |
| Bosch | DIVAR IP 7000 R2 | 0 – through 12.0.0 |
| Bosch | DIVAR IP all-in-one 5000 | 0 – through 12.0.0 |
| Bosch | DIVAR IP all-in-one 7000 | 0 – through 12.0.0 |
| Bosch | DIVAR IP all-in-one 7000 R3 | 0 – through 12.0.0 |
| Bosch | DIVAR IP all-in-one 4000 | 0 – through 12.0.0 |
| Bosch | DIVAR IP all-in-one 6000 | 0 – through 12.0.0 |
| Bosch | Project Assistant | 0 – through 2.3 |
| Bosch | Video Security Client | 0 – through 3.3.5 |
| Bosch | BIS Video Engine | 0 – through 5.0.1 |
| Bosch | Intelligent Insights | 0 – through 1.0.3.14 |
| Bosch | ONVIF Camera Event Driver Tool | 0 – through 2.0.0.8 |
Weakness: CWE-703 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H