What is the CVSS score of CVE-2023-28175?

CVE-2023-28175 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Video Management System CVE-2023-28175

HIGH

Information Exposure (CWE-200)

2023-06-15 psirt@bosch.com

Information Disclosure Video Management System Video Management System Viewer Divar Ip 3000 Firmware Divar Ip 6000 Firmware Divar Ip 4000 Firmware Divar Ip 5000 Firmware Divar Ip 7000 R2 Firmware Divar Ip 7000 Firmware Divar Ip 7000 R3 Firmware

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jun 15, 2023 - 11:15 nvd

HIGH 7.7

DescriptionNVD

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.

AnalysisAI

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request. Affected products include: Bosch Video Management System, Bosch Video Management System Viewer, Bosch Divar Ip 3000 Firmware, Bosch Divar Ip 6000 Firmware, Bosch Divar Ip 4000 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.