CVE-2019-8952
Description
A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032).
How to fix
- bosch divar_ip_2000_firmware3.62.0019 or later
- bosch divar_ip_5000_firmware3.80.0033 or later
- bosch video_management_system3.71.0032 or later
- bosch video_recording_manager3.71.0032, 3.81.0032 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bosch divar_ip_2000_firmware | v < 3.62.0019 | 3.62.0019 |
| bosch divar_ip_5000_firmware | v < 3.80.0033 | 3.80.0033 |
| bosch video_management_system | v < 3.71.0032 | 3.71.0032 |
| bosch video_recording_manager | v < 3.71.0032, 3.81 ≤ v < 3.81.0032 | 3.71.0032, 3.81.0032 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.