Lucene search

K
cvelistBoschCVELIST:CVE-2021-23862
HistoryDec 08, 2021 - 12:00 a.m.

CVE-2021-23862 Authenticated Remote Code Execution

2021-12-0800:00:00
CWE-20
bosch
www.cve.org

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.0%

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000).

CNA Affected

[
  {
    "product": "BVMS",
    "vendor": "Bosch",
    "versions": [
      {
        "lessThanOrEqual": "9.0.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "11.0.0",
        "status": "affected",
        "version": "11.0",
        "versionType": "custom"
      },
      {
        "lessThan": "10.0.2",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "lessThan": "10.1.1",
        "status": "affected",
        "version": "10.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "DIVAR IP 7000 R2",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "product": "DIVAR IP all-in-one 5000",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "product": "DIVAR IP all-in-one 7000",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "product": "VRM",
    "vendor": "Bosch",
    "versions": [
      {
        "lessThanOrEqual": "3.81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.00.0070",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.83.0021",
        "status": "affected",
        "version": "3.83",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.82.0057",
        "status": "affected",
        "version": "3.82",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "VJD-8000",
    "vendor": "Bosch",
    "versions": [
      {
        "lessThanOrEqual": "10.01.0036",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "VJD-7513",
    "vendor": "Bosch",
    "versions": [
      {
        "lessThanOrEqual": "10.22.0038",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.0%

Related for CVELIST:CVE-2021-23862