CVE-2023-28175

State: Published
Severity: 7.1 High
Published: Jun 15, 2023
Updated: Dec 17, 2024
Reserved: Mar 13, 2023

Description

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N	bosch

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
BVMSBosch	7.5 through 11.1.1Affected
BVMS ViewerBosch	7.5 through 11.1.1Affected
Bosch DIVAR IP 3000Bosch	7.5 through 8.0Affected
Bosch DIVAR IP 7000 R1Bosch	7.5 through 8.0Affected
Bosch DIVAR IP 7000 R2Bosch	7.5 through 11.1.1Affected
Bosch DIVAR IP all-in-one 7000 R3Bosch	10.1.1 through 11.1.1Affected
Bosch DIVAR IP all-in-one 5000Bosch	9.0 through 11.1.1Affected
Bosch DIVAR IP all-in-one 7000Bosch	9.0 through 11.1.1Affected
DIVAR IP all-in-one 4000Bosch	11.1.1Affected
DIVAR IP all-in-one 6000Bosch	11.1.1Affected

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.