Bosch Video Management System
CVE-2022-32540
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.
AnalysisAI
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x. Affected products include: Bosch Bosch Video Management System, Bosch Videojet Decoder 7513 Firmware. Version information: version 8..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DI
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DI
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. Rated high severity
A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in
By executing a special command, an user with administrative rights can get access to extended debug functionality on the
An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. Rat
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthe
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today