CVE-2019-6958: Improper Access Control for Bosch Video Systems, PSIM and Access Control Systems
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The RCP+ network port allows access without authentication. Adding authentication feature to the respective library fixes the issue. The issue is classified as "CWE-284: Improper Access Control." This vulnerability, for example, allows a potential attacker to delete video or read video data.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this security vulnerability?
The vulnerability ID for this security vulnerability is CVE-2019-6958.
Which software versions are affected by this vulnerability?
This vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Bosch Video Client, Bosch Building Integration System, Bosch Configuration Manager, and Bosch Video SDK.
What is the severity rating of CVE-2019-6958?
The severity rating of CVE-2019-6958 is critical with a score of 9.1.
How can I check if my system is vulnerable to CVE-2019-6958?
To determine if your system is vulnerable to CVE-2019-6958, you can check the version of the affected software installed on your system and compare it with the list of affected versions provided in the security advisory.
Is there a fix available for CVE-2019-6958?
Yes, a fix is available for CVE-2019-6958. It is recommended to update the affected software to the latest patched version provided by Bosch.