CVE-2020-6770criticalCWE-502

CVE-2020-6770: critical vulnerability in Bosch BVMS Mobile Video Service

Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service

Published · Updated

Follow this CVE+ Monitor DIVAR IP+ Monitor BVMS Mobile Video Service

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 3.6%
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Bosch · BVMS Mobile Video ServiceBosch · DIVAR IP 3000Bosch · DIVAR IP 7000
Related CVEs — Bosch BVMS Mobile Video Service

In the same product, most dangerous first.

CVE-2020-6769CRITICALMissing Authentication for Critical Function in Bosch Video Streaming GatewayEPSS 2.2%CVE-2020-6768HIGHPath Traversal in Bosch Video Management System (BVMS)EPSS 1.7%CVE-2020-6767HIGHPath Traversal in Bosch Video Management System (BVMS)EPSS 1.3%