What is the CVSS score of CVE-2023-35867?

CVE-2023-35867 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Building Integration System Video Engine CVE-2023-35867

MEDIUM

Improper Check or Handling of Exceptional Conditions (CWE-703)

2023-12-18 psirt@bosch.com

Denial Of Service Building Integration System Video Engine Bosch Video Management System Video Management System Viewer Configuration Manager Divar Ip 7000 R2 Firmware Divar Ip All In One 4000 Firmware Divar Ip All In One 5000 Firmware Divar Ip All In One 6000 Firmware Divar Ip All In One 7000 Firmware Divar Ip All In One 7000 R3 Firmware Intelligent Insights Onvif Camera Event Driver Tool Project Assistant Video Security Client

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Dec 18, 2023 - 13:15 nvd

MEDIUM 5.9

DescriptionNVD

An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.

AnalysisAI

An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-703. An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks. Affected products include: Bosch Building Integration System Video Engine, Bosch Bosch Video Management System, Bosch Video Management System Viewer, Bosch Configuration Manager, Bosch Divar Ip 7000 R2 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.