9

CVE-2021-23862

Authenticated Remote Code Execution

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bosch ≫ Bosch Video Management System Version <= 9.0
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Bosch Video Management System Version >= 10.0 < 10.0.2
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Bosch Video Management System Version 10.1
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Bosch Video Management System Version 11.0
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Video Recording Manager Version <= 3.81
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Video Recording Manager Version >= 3.82 <= 3.82.0057
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Video Recording Manager Version >= 3.83 <= 3.83.0021
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Video Recording Manager Version >= 4.0 <= 4.00.0070
   Bosch ≫ Divar Ip 5000 Firmware Version -
   Bosch ≫ Divar Ip 7000 Firmware Version -
Bosch ≫ Videojet Decoder 7513 Firmware Version <= 10.22.0038
   Bosch ≫ Videojet Decoder 7513 Version -
Bosch ≫ Videojet Decoder 8000 Firmware Version <= 10.01.0036
   Bosch ≫ Videojet Decoder 8000 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.39% 0.688
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
Bosch 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html
Vendor Advisory