CVE-2023-35867
Medium
Description
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
SeverityMedium
CVSS5.9
Exploit probability—
ProductBosch Video Management System
PublishedDec 18, 2023
First seenDec 18, 2023
Weakness typeCWE-703CWE-703
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bosch bosch_video_management_system | v ≤ 12.0 | — |
| bosch building_integration_system_video_engine | v ≤ 5.0.1 | — |
| bosch video_management_system_viewer | v ≤ 12.0 | — |
| bosch configuration_manager | v ≤ 7.62 | — |
| bosch divar_ip_7000_r2_firmware | v ≤ 12.0 | — |
| bosch divar_ip_all-in-one_4000_firmware | v ≤ 12.0 | — |
| bosch divar_ip_all-in-one_5000_firmware | v ≤ 12.0 | — |
| bosch divar_ip_all-in-one_6000_firmware | v ≤ 12.0 | — |
| bosch divar_ip_all-in-one_7000_firmware | v ≤ 12.0 | — |
| bosch divar_ip_all-in-one_7000_r3_firmware | v ≤ 12.0 | — |
| bosch intelligent_insights | v ≤ 1.0.3.14 | — |
| bosch _onvif_camera_event_driver_tool | v ≤ 2.0.0.8 | — |
| bosch project_assistant | v ≤ 2.3 | — |
| bosch video_security_client | v ≤ 3.3.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.