CVE-2019-6958
CRITICALBosch Video Management System <9.0 - Unauthenticated RCE
Title source: llmDescription
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The RCP+ network port allows access without authentication. Adding authentication feature to the respective library fixes the issue. The issue is classified as "CWE-284: Improper Access Control." This vulnerability, for example, allows a potential attacker to delete video or read video data.
References (1)
Core 1
Core References
Mitigation, Vendor Advisory x_refsource_confirm
https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0404bt-cve-2019-6958_security_advisory_improper_access_control.pdf
Scores
CVSS v3
9.1
EPSS
0.0152
EPSS Percentile
71.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-306
Status
published
Products (17)
bosch/access_easy_controller_firmware
2.1.8.5
bosch/access_easy_controller_firmware
2.1.9.0
bosch/access_easy_controller_firmware
2.1.9.1
bosch/access_easy_controller_firmware
2.1.9.3
bosch/access_professional_edition
3.0 - 3.7
bosch/bosch_video_client
< 1.7.6.079
bosch/bosch_video_management_system
< 9.0
bosch/building_integration_system
4.5
bosch/building_integration_system
4.6
bosch/building_integration_system
4.6.1
... and 7 more
Published
May 29, 2019
Tracked Since
Feb 18, 2026