Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2020-6768

Path Traversal in Bosch Video Management System (BVMS)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
bosch

Description

A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Bosch DIVAR IP 3000

  • Allaffected

Bosch DIVAR IP 7000

  • Allaffected

Bosch DIVAR IP all-in-one 5000

  • Allaffected

Bosch Bosch Video Management System

  • unspecified to ≤ 7.5affected
  • unspecified to ≤ 8.0.0.329affected
  • unspecified to ≤ 9.0.0.827affected
  • unspecified to ≤ 10.0.0.1225affected

Bosch BVMS Viewer

  • unspecified to ≤ 7.5affected
  • unspecified to ≤ 8.0.0.329affected
  • unspecified to ≤ 9.0.0.827affected
  • unspecified to ≤ 10.0.0.1225affected

References