10

CVE-2019-11684

Improper Access Control in Bosch Video Recording Manager

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bosch ≫ Video Recording Manager Version >= 3.70 < 3.71.0034
Bosch ≫ Video Recording Manager Version >= 3.81 < 3.81.0050
Bosch ≫ Divar Ip 5000 Firmware Version >= 3.80 < 3.80.0039
   Bosch ≫ Divar Ip 5000 Version -
Bosch ≫ Video Management System Version 3.70.0056
Bosch ≫ Video Management System Version 3.70.0058
Bosch ≫ Video Management System Version 3.70.0060
Bosch ≫ Video Management System Version 3.70.0062
Bosch ≫ Video Management System Version 3.71.0022
Bosch ≫ Video Management System Version 3.71.0029
Bosch ≫ Video Management System Version 3.71.0031
Bosch ≫ Video Management System Version 3.71.0032
Bosch ≫ Video Management System Version 3.81.0032
Bosch ≫ Video Management System Version 3.81.0038
Bosch ≫ Video Management System Version 3.81.0048
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.99% 0.578
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
MITRE 9.9 3.9 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://psirt.bosch.com/security-advisories/bosch-sa-804652.html
Vendor Advisory