Lucene search

[email protected]NVD:CVE-2020-6770

HistoryFeb 07, 2020 - 9:15 p.m.

CVE-2020-6770

2020-02-0721:15:10

CWE-502

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.012

Percentile

85.0%

JSON

Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.

Affected configurations

Nvd

Node

boschbosch_video_management_system_mobile_video_serviceRange≤7.5

boschbosch_video_management_system_mobile_video_serviceRange8.0–8.0.0.329

boschbosch_video_management_system_mobile_video_serviceRange9.0–9.0.0.827

boschbosch_video_management_system_mobile_video_serviceRange10.0–10.0.0.1225

Node

boschdivar_ip_3000_firmwareMatch-

AND

boschdivar_ip_3000Match-

Node

boschdivar_ip_7000_firmwareMatch-

AND

boschdivar_ip_7000Match-

VendorProductVersionCPE
boschbosch_video_management_system_mobile_video_service*cpe:2.3:a:bosch:bosch_video_management_system_mobile_video_service:*:*:*:*:*:*:*:*
boschdivar_ip_3000_firmware-cpe:2.3:o:bosch:divar_ip_3000_firmware:-:*:*:*:*:*:*:*
boschdivar_ip_3000-cpe:2.3:h:bosch:divar_ip_3000:-:*:*:*:*:*:*:*
boschdivar_ip_7000_firmware-cpe:2.3:o:bosch:divar_ip_7000_firmware:-:*:*:*:*:*:*:*
boschdivar_ip_7000-cpe:2.3:h:bosch:divar_ip_7000:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bosch	bosch_video_management_system_mobile_video_service	*	cpe:2.3:a:bosch:bosch_video_management_system_mobile_video_service::::::::
bosch	divar_ip_3000_firmware	-	cpe:2.3:o:bosch:divar_ip_3000_firmware:-:::::::*
bosch	divar_ip_3000	-	cpe:2.3:h:bosch:divar_ip_3000:-:::::::*
bosch	divar_ip_7000_firmware	-	cpe:2.3:o:bosch:divar_ip_7000_firmware:-:::::::*
bosch	divar_ip_7000	-	cpe:2.3:h:bosch:divar_ip_7000:-:::::::*

References

psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.012

Percentile

85.0%

JSON

Related for NVD:CVE-2020-6770

prion1 cvelist1 cve1