Lucene search

[email protected]CVE-2019-11684

HistoryFeb 26, 2021 - 4:15 p.m.

CVE-2019-11684

2021-02-2616:15:12

CWE-306

[email protected]

web.nvd.nist.gov

cve-2019-11684

improper access control

bosch vrm

unauthenticated access

certificates

security vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.

Affected configurations

NVD

Node

boschvideo_recording_managerRange3.70–3.71.0034

boschvideo_recording_managerRange3.81–3.81.0050

Node

boschdivar_ip_5000Match-

AND

boschdivar_ip_5000_firmwareRange3.80–3.80.0039

Node

boschvideo_management_systemMatch3.70.0056

boschvideo_management_systemMatch3.70.0058

boschvideo_management_systemMatch3.70.0060

boschvideo_management_systemMatch3.70.0062

boschvideo_management_systemMatch3.71.0022

boschvideo_management_systemMatch3.71.0029

boschvideo_management_systemMatch3.71.0031

boschvideo_management_systemMatch3.71.0032

boschvideo_management_systemMatch3.81.0032

boschvideo_management_systemMatch3.81.0038

boschvideo_management_systemMatch3.81.0048

CPENameOperatorVersion
bosch:video_recording_managerbosch video recording managerlt3.71.0034
bosch:video_recording_managerbosch video recording managerlt3.81.0050

CPE	Name	Operator	Version
bosch:video_recording_manager	bosch video recording manager	lt	3.71.0034
bosch:video_recording_manager	bosch video recording manager	lt	3.81.0050

References

psirt.bosch.com/security-advisories/bosch-sa-804652.html

Social References

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

Related for CVE-2019-11684

prion1 cvelist1 nvd1