CVE-2023-35867

An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.

• bosch building integration system video engine (<= 5.0.1) • bosch bosch video management system (<= 12.0) • bosch video management system viewer (<= 12.0) • bosch configuration manager (<= 7.62) • bosch divar ip 7000 r2 firmware (<= 12.0) • bosch divar ip all-in-one 4000 firmware (<= 12.0) • bosch divar ip all-in-one 5000 firmware (<= 12.0) • bosch divar ip all-in-one 6000 firmware (<= 12.0) • bosch divar ip all-in-one 7000 firmware (<= 12.0) • bosch divar ip all-in-one 7000 r3 firmware (<= 12.0) • bosch intelligent insights (<= 1.0.3.14) • bosch onvif camera event driver tool (<= 2.0.0.8) • bosch project assistant (<= 2.3) • bosch video security client (<= 3.3.5)