Bosch Access Professional Edition vulnerabilities

5 CVEs affecting Bosch Access Professional Edition, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-23843, published 2022-01-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-6957, published 2019-05-29. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager (VRM), Video…
CVE-2019-6958, published 2019-05-29. Critical severity, CVSS 9.1. EPSS: 1.5% chance of exploitation in the next 30 days. A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration…
CVE-2021-23859, published 2021-12-08. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to…
CVE-2021-23843, published 2022-01-19. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password protection on configured devices to…
CVE-2021-23842, published 2022-01-19. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic…