High severity · published Mar 25, 2021
CVE-2020-6786
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VR
Video Recording Manager · Bosch
through 3.71; 3.81 through 3.81.0064; 3.82 through 3.82.0055 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6786
Vendor Advisory
https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
More from Video Recording Manager
9.8
CVE-2019-11684
Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates,…
9.8
CVE-2019-6957
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager…
7.5
CVE-2023-32230
An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation
7.5
CVE-2021-23859
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash
7.2
CVE-2021-23862
A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context