EUVD-2026-89756
GHSA-wwxh-c3v3-3g3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain man-in-the-middle position on network path
-
ExploitIntercept BVMS client-server traffic
-
ExecutionDecrypt using hard-coded cryptographic key
-
ImpactExtract sensitive data in transit
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Key management, no hard-coded keys
|
| Exploitation Conditions | Exploitation requires the attacker to occupy a man-in-the-middle position on the network path between BVMS components (versions 4.5 up to 12.3) to intercept the target traffic - this is the primary limiting factor and the reason for the AC:H rating. The underlying enabler is a hard-coded cryptographic key (CWE-321) shipped in the product, which lets the interceptor decrypt captured traffic without needing credentials (PR:N) or user interaction (UI:N). Practical risk is therefore constrained to environments where an attacker can achieve traffic interception (shared network segments, spoofing, or a compromised intermediate device); it is not exploitable purely remotely against an isolated, well-segmented deployment. |
| Impact | The vendor CVSS of 8.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) is driven up by the scope change (S:C) and dual high confidentiality/integrity impact, but the real-world risk is materially gated by AC:H, which reflects the core requirement of this CWE-321 (hard-coded cryptographic key) flaw: the attacker must first establish a man-in-the-middle position on the traffic path. No EPSS score, no CISA KEV listing, and no public proof-of-concept were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is best characterized as a genuine cryptographic weakness with a high theoretical impact but a meaningful practical barrier (network interception) rather than a drive-by remote exploit - a moderate priority rather than an emergency, especially given the niche deployment footprint. Note a labeling tension: the input Tags include 'Authentication Bypass,' but both the CWE-321 mapping and the description frame this as MITM-enabled information disclosure, so that tag overstates the primary impact. |
| Exploit ScenarioDerived | An attacker positioned on the network path between a BVMS client and server (e.g., on a shared LAN segment, via ARP/DNS spoofing, or a compromised upstream device) intercepts the encrypted session. Because a hard-coded cryptographic key (CWE-321) is embedded in the product, the attacker uses that known key to decrypt the intercepted traffic and read sensitive data in transit. No public PoC is available, and success depends on achieving the man-in-the-middle position, consistent with the AC:H rating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Man-in-the-middle attackers can intercept and decrypt sensitive BVMS traffic across versions 4.5 through 12.3 because the product relies on a hard-coded cryptographic key (CWE-321), allowing unauthorized access to confidential data and, per the assessed impact, tampering with protected communications. The flaw is remotely reachable and requires no credentials (PR:N) or user interaction (UI:N), and it carries a high severity rating of 8.7 with a scope change reflecting impact beyond the vulnerable component. Risk is materially gated by the high attack complexity (AC:H): the attacker must first obtain a man-in-the-middle position on the network path between BVMS components, so it is not exploitable purely remotely against an isolated, well-segmented deployment. No confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the available data; confirm the fixed build and any interim guidance in the IQSIGHT advisory IQSIGHT-SA-261342 (https://www.iqsight.com/f/292130204896374/x/594fff1c4a/iqsight-sa-261342.pdf) and apply the vendor-provided update as soon as it is published. Because the defect is a hard-coded cryptographic key, effective compensating controls target the man-in-the-middle prerequisite: keep all BVMS component-to-component traffic on a dedicated, isolated VLAN or point-to-point links so an attacker cannot reach a position on the path - trade-off is reduced deployment flexibility and added network engineering effort. Where components must traverse shared or untrusted infrastructure, tunnel that traffic inside an independently keyed encryption layer (for example IPsec or TLS using per-deployment certificates that you generate and manage yourself, not product-embedded keys), which does not repair the flawed key but prevents an interceptor from reading the payload - trade-off is added latency, certificate lifecycle management, and possible MTU/TLS-version tuning. Harden the layer 2 path with port security, DHCP snooping, Dynamic ARP Inspection, and 802.1X on all switches carrying BVMS traffic to make spoofing and interception harder - trade-off is administrative overhead and risk of breaking devices that cannot authenticate. Restrict management and inter-component ports with host-based and network ACLs to known component addresses, and monitor for ARP spoofing, unexpected certificate or peer changes, and anomalous traffic patterns that would indicate an interceptor. Note that these controls reduce exposure but do not eliminate the underlying weakness, since any traffic the attacker can capture while the hard-coded key is in use remains decryptable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-321, Use of Hard-coded Cryptographic Key. Rather than deriving or provisioning unique key material per installation, BVMS ships a static cryptographic key that is used to protect communications between the product's components. Because that key is embedded in the product and therefore recoverable by anyone with access to the software, an adversary who can passively or actively sit on the network path between components can decrypt captured traffic and potentially forge or inject messages that the peer will accept as authentic - which is why the assessed impact includes both high confidentiality (C:H) and high integrity (I:H), with no availability impact (A:N). The scope change (S:C) reflects that the compromised cryptographic trust relationship reaches beyond the vulnerable component to the data and peers it protects. The CPE cpe:2.3:a:iqsight:bvms:*:*:*:*:*:*:*:* confirms the affected platform is IQSIGHT BVMS (the video management system line originating from Bosch Video Management System), and the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N is consistent with this class: no authentication and no user interaction are needed once traffic interception is achieved, but the AC:H rating reflects that interception is a prerequisite, not a given. The associated 'Authentication Bypass' and 'Information Disclosure' tags align with an attacker using the recovered key material to bypass the trust that the hard-coded key is supposed to establish.
Know when Bvms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
AC:H because a man-in-the-middle position is required; PR:N/UI:N as the hard-coded key needs no credentials; S:C and C:H/I:H reflect decryption of sensitive cross-system data with no availability impact.
Primary rating from Vendor (IQSIGHT).
CVSS VectorVendor: IQSIGHT
DescriptionCVE.org
Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data.
Executive ViewAI
A hard-coded cryptographic key in Bosch BVMS versions 4.5 through 12.3 lets an attacker who has already gained a position on the network path between BVMS components decrypt and tamper with sensitive surveillance traffic, exposing video feeds, credentials, and system communications. No vendor patch is available and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in environments where BVMS components traverse shared, flat, or untrusted network segments rather than isolated, well-segmented deployments. Leadership should treat this as an architecture and network-segmentation issue affecting physical security operations, not a routine patch-cycle item.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly segment BVMS servers, clients, and cameras onto dedicated VLANs with deny-by-default inter-segment rules to deny attackers the man-in-the-middle network position the flaw requires; tunnel all BVMS component traffic through authenticated, encrypted channels (IPsec or MACsec) that are independent of the hard-coded key; remove BVMS interfaces from untrusted or shared networks and restrict them to managed, physically controlled segments; enable port security, DHCP snooping, and dynamic ARP inspection to block spoofing on BVMS paths; monitor BVMS segments for tampering and anomalous east-west traffic; and track the Bosch advisory for a fixed release replacing affected versions 4.5 through 12.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB