Deserialization in Bosch Video Management System Mobile Service
CVE-2020-6770
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.036 (89.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.036 · newest: 0.036 · change: 0.000
Affected products
- Bosch Video Management System Mobile Service
- Bosch Bvms Mobile Video Service — versions unspecified
- Bosch Divar Ip 3000 — versions All
- Bosch Divar Ip 3000
- Bosch Divar Ip 3000 Firmware
- Bosch Divar Ip 7000 — versions All
- Bosch Divar Ip 7000
- Bosch Divar Ip 7000 Firmware
Weakness classification (CWE)
References
- psirt.bosch.com/security-advisories/BOSCH-SA-885551-BT.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-6770?
- CVE-2020-6770 is a critical-severity vulnerability in Bosch Video Management System Mobile Service, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2020-02-07.
- How severe is CVE-2020-6770?
- Critical severity. CVSS v3 base score is 10.0 out of 10.