Description
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bosch | BVMS | ≤ 12.0.0 | — |
| Bosch | BVMS Viewer | ≤ 12.0.0 | — |
| Bosch | Configuration Manager | ≤ 7.62 | — |
| Bosch | DIVAR IP 7000 R2 | ≤ 12.0.0 | — |
| Bosch | DIVAR IP all-in-one 5000 | ≤ 12.0.0 | — |
| Bosch | DIVAR IP all-in-one 7000 | ≤ 12.0.0 | — |
| Bosch | DIVAR IP all-in-one 7000 R3 | ≤ 12.0.0 | — |
| Bosch | DIVAR IP all-in-one 4000 | ≤ 12.0.0 | — |
| Bosch | DIVAR IP all-in-one 6000 | ≤ 12.0.0 | — |
| Bosch | Project Assistant | ≤ 2.3 | — |
| Bosch | Video Security Client | ≤ 3.3.5 | — |
| Bosch | BIS Video Engine | ≤ 5.0.1 | — |
| Bosch | Intelligent Insights | ≤ 1.0.3.14 | — |
| Bosch | ONVIF Camera Event Driver Tool | ≤ 2.0.0.8 | — |