10

CVE-2019-11684

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bosch ≫ Video Recording Manager Version >= 3.70 < 3.71.0034
Bosch ≫ Video Recording Manager Version >= 3.81 < 3.81.0050
Bosch ≫ Divar Ip 5000 Firmware Version >= 3.80 < 3.80.0039
   Bosch ≫ Divar Ip 5000 Version-
Bosch ≫ Video Management System Version3.70.0056
Bosch ≫ Video Management System Version3.70.0058
Bosch ≫ Video Management System Version3.70.0060
Bosch ≫ Video Management System Version3.70.0062
Bosch ≫ Video Management System Version3.71.0022
Bosch ≫ Video Management System Version3.71.0029
Bosch ≫ Video Management System Version3.71.0031
Bosch ≫ Video Management System Version3.71.0032
Bosch ≫ Video Management System Version3.81.0032
Bosch ≫ Video Management System Version3.81.0038
Bosch ≫ Video Management System Version3.81.0048
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.396
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
cve@mitre.org 9.9 3.9 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.