CVE-2020-6769

Missing Authentication for Critical Function in Bosch Video Streaming Gateway

State: Published
Severity: 10.0 Critical
Published: Feb 7, 2020
Updated: Sep 16, 2024
Reserved: Jan 10, 2020

Description

Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiality and availability of live and recorded video data of all cameras configured to be controlled by the VSG as well as the recording storage associated with the VSG. This affects Bosch Video Streaming Gateway versions 6.45 <= 6.45.08, 6.44 <= 6.44.022, 6.43 <= 6.43.0023 and 6.42.10 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable VSG version is installed with BVMS. This affects Bosch DIVAR IP 2000 <= 3.62.0019 and DIVAR IP 5000 <= 3.80.0039 if the corresponding port 8023 has been opened in the device's firewall.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	bosch

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
DIVAR IP 2000Bosch	3.62.0019 and earlierAffected
DIVAR IP 5000Bosch	3.80.0039 and earlierAffected
Video Streaming GatewayBosch	6.45 through 6.45.08Affected 6.44 through 6.44.0030Affected 6.43 through 6.43.0023Affected 6.42 and older through 6.42.10Affected
DIVAR IP 3000Bosch	AllAffected
DIVAR IP 7000Bosch	AllAffected
DIVAR IP all-in-one 5000Bosch	AllAffected

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-260625-BT.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.