Critical severity · published May 29, 2019
CVE-2019-6958
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager,…
9.1
CVSS
1.5%
EPSS
No
On KEV
Description
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The RCP+ network port allows access without authentication. Adding authentication feature to the respective library fixes the issue. The issue is classified as "CWE-284: Improper Access Control." This vulnerability, for example, allows a potential attacker to delete video or read video data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Access Easy Controller Firmware · Bosch
2.1.8.5; 2.1.9.0; 2.1.9.1; 2.1.9.3 · source: NVD
AP
Access Professional Edition · Bosch
3.0 through 3.7 · source: NVD
BV
Bosch Video Client · Bosch
before 1.7.6.079 · source: NVD
BV
Bosch Video Management System · Bosch
through 9.0 · source: NVD
BI
Building Integration System · Bosch
2.2 through 4.4; 4.5; 4.6; 4.6.1 · source: NVD
CM
Configuration Manager · Bosch
before 6.10 · source: NVD
D2
Dip 2000 Firmware · Bosch
before 0380.037 · source: NVD
D3
Dip 3000 Firmware · Bosch
All versions, or not specified · source: NVD
D5
Dip 5000 Firmware · Bosch
before 038.037 · source: NVD
D7
Dip 7000 Firmware · Bosch
All versions, or not specified · source: NVD
VS
Video Sdk · Bosch
before 6.32.0099 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6958
Mitigation
https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0404bt-cve-2019-6958_security_advisory_improper_access_control.pdf
More from Access Easy Controller Firmware
9.8
CVE-2019-6957
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager…
7.5
CVE-2021-23859
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash