CVE-2020-6770 - Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service

Back Back to CVE browser

CRITICAL

Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service

Published Feb 7, 2020

10.0

CRITICAL

CVSS 3.1

EPSS 3.64%

Description

Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.

Affected products

Vendor Bosch Product BVMS Mobile Video Service Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=10.0.0.1225
- Version
  unspecified
  Status
  affected
  Constraints
  <=7.5
- Version
  unspecified
  Status
  affected
  Constraints
  <=8.0.0.329
- Version
  unspecified
  Status
  affected
  Constraints
  <=9.0.0.827
Vendor Bosch Product Divar IP 3000 Default
n/a
- Version
  All
  Status
  affected
  Constraints
  -
Vendor Bosch Product Divar IP 7000 Default
n/a
- Version
  All
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bosch

BVMS Mobile Video Service

n/a

Version	Status	Constraints
unspecified	affected	<=10.0.0.1225
unspecified	affected	<=7.5
unspecified	affected	<=8.0.0.329
unspecified	affected	<=9.0.0.827

Bosch

Divar IP 3000

n/a

Version	Status	Constraints
All	affected	-

Bosch

Divar IP 7000

n/a

Version	Status	Constraints
All	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27917
Advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27917		Advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html		x_refsource_CONFIRMVendor Advisory