CVEvulnerability

CVE-2020-6767

6.5 MEDIUM Published 2020-02-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-22

Description

A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.

Affected configurations

• bosch video management system viewer (<= 7.5) • bosch video management system viewer (>= 8.0 <= 8.0.329) • bosch video management system viewer (>= 9.0 <= 9.0.0.827) • bosch video management system viewer (>= 10.0 <= 10.0.0.1225) • bosch video management system (<= 7.5) • bosch video management system (>= 8.0 <= 8.0.0.329) • bosch video management system (>= 9.0 <= 9.0.0.827) • bosch video management system (>= 10.0 <= 10.0.0.1225)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References