Description
A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bosch | DIVAR IP 3000 | All | — |
| Bosch | DIVAR IP 7000 | All | — |
| Bosch | DIVAR IP all-in-one 5000 | All | — |
| Bosch | Bosch Video Management System | 7.0 and older, 7.5 and older, 8.0 through 8.0.0.329, 9.0 through 9.0.0.827, 10.0 through 10.0.0.1225 | — |
| Bosch | BVMS Viewer | 7.0 and older, 7.5 and older, 8.0 through 8.0.0.329, 9.0 through 9.0.0.827, 10.0 through 10.0.0.1225 | — |