CVE-2020-6768
Description
A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bosch video_management_system_viewer | v ≤ 7.5, 8.0 ≤ v ≤ 8.0.329, 9.0 ≤ v ≤ 9.0.0.827, 10.0 ≤ v ≤ 10.0.0.1225 | — |
| bosch video_management_system | v ≤ 7.5, 8.0 ≤ v ≤ 8.0.0.329, 9.0 ≤ v ≤ 9.0.0.827, 10.0 ≤ v ≤ 10.0.0.1225 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.