CVE-2020-6770

CRITICAL

Bosch BVMS Mobile Video Service < 7.5 - Unauthenticated Remote Code Execution via Untrusted Data Deserialization

Title source: llm
STIX 2.1

Description

Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.

References (1)

Core 1
Core References

Scores

CVSS v3 10.0
EPSS 0.0364
EPSS Percentile 88.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (3)
bosch/bosch_video_management_system_mobile_video_service < 7.5
bosch/divar_ip_3000_firmware
bosch/divar_ip_7000_firmware
Published Feb 07, 2020
Tracked Since Feb 18, 2026