Critical severity · published May 29, 2019
CVE-2019-6957
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager…
9.8
CVSS
2%
EPSS
No
On KEV
Description
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager (VRM), Video Streaming Gateway (VSG), Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The vulnerability potentially allows the unauthorized execution of code in the system via the network interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Access Easy Controller Firmware · Bosch
2.1.8.5; 2.1.9.0; 2.1.9.1; 2.1.9.3 · source: NVD
AP
Access Professional Edition · Bosch
3.0 through 3.7 · source: NVD
BV
Bosch Video Client · Bosch
before 1.7.6.079 · source: NVD
BV
Bosch Video Management System · Bosch
through 9.0 · source: NVD
BI
Building Integration System · Bosch
2.2 through 4.4; 4.5; 4.6; 4.6.1 · source: NVD
CM
Configuration Manager · Bosch
before 6.10 · source: NVD
D2
Dip 2000 Firmware · Bosch
before 0380.037 · source: NVD
D3
Dip 3000 Firmware · Bosch
All versions, or not specified · source: NVD
D5
Dip 5000 Firmware · Bosch
before 038.037 · source: NVD
D7
Dip 7000 Firmware · Bosch
All versions, or not specified · source: NVD
VR
Video Recording Manager · Bosch
before 3.71.0032; 3.81 before 3.81.0048 · source: NVD
VS
Video Sdk · Bosch
before 6.32.0099 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6957
Vendor Advisory
https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0403bt-cve-2019-6957_security_advisory_software_buffer_overflow.pdf
More from Access Easy Controller Firmware
9.1
CVE-2019-6958
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager,…
7.5
CVE-2021-23859
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash