Bosch Video Management System Viewer vulnerabilities

5 CVEs affecting Bosch Video Management System Viewer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-35867, published 2023-12-18.

More from Bosch.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-6768, published 2020-02-07. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects…
• CVE-2020-6767, published 2020-02-06. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects…
• CVE-2023-35867, published 2023-12-18. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this…
• CVE-2023-28175, published 2023-06-15. High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.
• CVE-2020-6785, published 2021-03-25. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code…