VulnerabilityModified

CVE-2019-6958

CRITICAL 9.1EPSS 1.52%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The RCP+ network port allows access without authentication. Adding authentication feature to the respective library fixes the issue. The issue is classified as "CWE-284: Improper Access Control." This vulnerability, for example, allows a potential attacker to delete video or read video data.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.52% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: bosch/access professional edition · bosch/bosch video client · bosch/bosch video management system · bosch/building integration system · bosch/configuration manager · bosch/video sdk · bosch/dip 2000 firmware · bosch/dip 3000 firmware · bosch/dip 5000 firmware · bosch/dip 7000 firmware · bosch/access easy controller firmware
Source: cve@mitre.org

References

https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0404bt-cve-2019-6958_security_advisory_improper_access_control.pdfMitigation, Vendor Advisory
https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0404bt-cve-2019-6958_security_advisory_improper_access_control.pdfMitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.