by Kastro
Paper/Archive/CVE-2020-6770

CVE-2020-6770

Bosch DIVAR IP 3000 — Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service

EPSS 4%CVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 89.6.896 × 2017.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.

Affected

ProductAffectedFixed inSource
DIVAR IP 3000All–CNA
DIVAR IP 7000All–CNA
BVMS Mobile Video Serviceunspecified – 8.0.0.329–CNA
BVMS Mobile Video Serviceunspecified – 9.0.0.827–CNA
BVMS Mobile Video Serviceunspecified – 10.0.0.1225–CNA
BVMS Mobile Video Serviceunspecified – 7.5–CNA

Scores by source

bosch (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refpsirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html