Critical severity · published Feb 26, 2021
CVE-2019-11684
Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates,…
9.8
CVSS
1%
EPSS
No
On KEV
Description
Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Divar IP 5000 Firmware · Bosch
3.80 before 3.80.0039 · source: NVD
VM
Video Management System · Bosch
3.70.0056; 3.70.0058; 3.70.0060; 3.70.0062; 3.71.0022; 3.71.0029; +5 more · source: NVD
VR
Video Recording Manager · Bosch
3.70 before 3.71.0034; 3.81 before 3.81.0050 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11684
Vendor Advisory
https://psirt.bosch.com/security-advisories/bosch-sa-804652.html
More from Divar IP 5000 Firmware
9.1
CVE-2020-6769
Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data…
7.7
CVE-2023-28175
Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port…
6.5
CVE-2019-8952
A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products
6.1
CVE-2019-8951
An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products