Description
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
Metrics
CVSS 3.1 5.9/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Bosch | BVMS | <= 12.0.0 |
| Bosch | BVMS Viewer | <= 12.0.0 |
| Bosch | Configuration Manager | <= 7.62 |
| Bosch | DIVAR IP 7000 R2 | <= 12.0.0 |
| Bosch | DIVAR IP all-in-one 5000 | <= 12.0.0 |
| Bosch | DIVAR IP all-in-one 7000 | <= 12.0.0 |
| Bosch | DIVAR IP all-in-one 7000 R3 | <= 12.0.0 |
| Bosch | DIVAR IP all-in-one 4000 | <= 12.0.0 |
| Bosch | DIVAR IP all-in-one 6000 | <= 12.0.0 |
| Bosch | Project Assistant | <= 2.3 |
| Bosch | Video Security Client | <= 3.3.5 |
| Bosch | BIS Video Engine | <= 5.0.1 |
| Bosch | Intelligent Insights | <= 1.0.3.14 |
| Bosch | ONVIF Camera Event Driver Tool | <= 2.0.0.8 |
References
Timeline
- Published
- Dec 18, 2023
- Last modified
- Jun 17, 2026
- NVD status
- Modified