Medium severity · published Sep 30, 2022
CVE-2022-32540
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to…
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BV
BVMS · Bosch
11.1 through 11.1.0; 11.0 through 11.0.0; 10.1 through 10.1.1 · source: vendor
VJ
VJD-7513 · Bosch
10.23.0002; 10.30.0005 · source: vendor
BV
Bosch Video Management System · Bosch
10.1 through 10.1.1; 11.1 through 11.1.0; 11.0 · source: NVD
VD
Videojet Decoder 7513 Firmware · Bosch
10.23.0002; 10.30.0005 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-32540
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-32540
Broken Link
https://psirt.bosch.com/security-advisories/bosch-sa-464066.html
More from BVMS
7.5
CVE-2024-33618
Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network interface
5.9
CVE-2023-35867
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS)…