Lucene search

BoschCVELIST:CVE-2020-6790

HistoryMar 24, 2021 - 12:00 a.m.

CVE-2020-6790 Uncontrolled Search Path Element in Bosch Video Streaming Gateway Installer

2021-03-2400:00:00

CWE-427

bosch

www.cve.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

31.6%

JSON

Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim’s system. A prerequisite is that the victim is tricked into placing a malicious exe in the same directory where the installer is started from.

CNA Affected

[
  {
    "product": "Video Streaming Gateway",
    "vendor": "Bosch",
    "versions": [
      {
        "lessThanOrEqual": "6.45.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

31.6%

JSON

Related for CVELIST:CVE-2020-6790