Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-6769— Missing Authentication for Critical Function in Bosch Video Streaming Gateway

Quick assessment

Affected
Bosch DIVAR IP 2000
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bosch DIVAR IP 2000和Bosch DIVAR IP 3000都是德国Bosch公司的产品。Bosch DIVAR IP 2000是一款2000系列视频录像机。Bosch DIVAR IP 3000是一款3000系列视频录像机。 Bosch Video Streaming Gateway（VSG）中存在访问控制错误漏洞，该漏洞源于程序缺少身份验证。攻击者可利用该漏洞检索和设置Video Streaming Gateway的配置数据，影响实时和被录制的视频数据的保密性和可用性。以下产品及版本

CVSS 10.0 · Critical EPSS 2.22% · P81
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-6769

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing Authentication for Critical Function in Bosch Video Streaming Gateway
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 <= 6.45.08, 6.44 <= 6.44.022, 6.43 <= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 <= 3.62.0019 and DIVAR IP 5000 <= 3.80.0039 if the corresponding port 8023 has been opened in the device's firewall.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Bosch Video Streaming Gateway 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bosch DIVAR IP 2000和Bosch DIVAR IP 3000都是德国Bosch公司的产品。Bosch DIVAR IP 2000是一款2000系列视频录像机。Bosch DIVAR IP 3000是一款3000系列视频录像机。 Bosch Video Streaming Gateway（VSG）中存在访问控制错误漏洞，该漏洞源于程序缺少身份验证。攻击者可利用该漏洞检索和设置Video Streaming Gateway的配置数据，影响实时和被录制的视频数据的保密性和可用性。以下产品及版本
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Bosch DIVAR IP 2000 unspecified ~ 3.62.0019 -
Bosch DIVAR IP 5000 unspecified ~ 3.80.0039 -
Bosch Video Streaming Gateway 6.45 ~ 6.45.08 -
Bosch DIVAR IP 3000 All -
Bosch DIVAR IP 7000 All -
Bosch DIVAR IP all-in-one 5000 All -

II. Public POCs for CVE-2020-6769

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-6769

请登录查看更多情报信息。

Other References for CVE-2020-6769 (1)

Same Patch Batch · Bosch · 2020-02-07 · 3 CVEs total

CVE-2020-6770 10.0 CRITICAL Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service
CVE-2020-6768 8.6 HIGH Path Traversal in Bosch Video Management System (BVMS)

IV. Related Vulnerabilities

Same vendor: Bosch
Same weakness: CWE-306

V. Comments for CVE-2020-6769

No comments yet

Leave a comment