CVE-2020-6768: high-severity vulnerability in Bosch Video Management System
Path Traversal in Bosch Video Management System (BVMS)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 1.7%
A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
Bosch · Bosch Video Management SystemBosch · BVMS ViewerBosch · DIVAR IP 3000Bosch · DIVAR IP 7000Bosch · DIVAR IP all-in-one 5000Related CVEs — Bosch Video Management System
In the same product, most dangerous first.
CVE-2020-6770CRITICALDeserialization of Untrusted Data in Bosch BVMS Mobile Video ServiceEPSS 3.6%CVE-2020-6769CRITICALMissing Authentication for Critical Function in Bosch Video Streaming GatewayEPSS 2.2%CVE-2020-6767HIGHPath Traversal in Bosch Video Management System (BVMS)EPSS 1.3%CVE-2023-35867MEDIUMCVE-2023-35867EPSS 0.6%CVE-2023-28175HIGHCVE-2023-28175EPSS 0.5%CVE-2024-33618HIGHCVE-2024-33618EPSS 0.5%