CVE-2020-6767: high-severity vulnerability in Bosch Video Management System
Path Traversal in Bosch Video Management System (BVMS)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 1.3%
A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Bosch · Bosch Video Management SystemBosch · BVMS ViewerBosch · DIVAR IP 3000Bosch · DIVAR IP 7000Bosch · DIVAR IP all-in-one 5000Related CVEs — Bosch Video Management System
In the same product, most dangerous first.
CVE-2020-6770CRITICALDeserialization of Untrusted Data in Bosch BVMS Mobile Video ServiceEPSS 3.6%CVE-2020-6769CRITICALMissing Authentication for Critical Function in Bosch Video Streaming GatewayEPSS 2.2%CVE-2020-6768HIGHPath Traversal in Bosch Video Management System (BVMS)EPSS 1.7%CVE-2023-35867MEDIUMCVE-2023-35867EPSS 0.6%CVE-2023-28175HIGHCVE-2023-28175EPSS 0.5%CVE-2024-33618HIGHCVE-2024-33618EPSS 0.5%