CVE-2019-8952: Path Traversal
First published: Mon May 13 2019(Updated: )
A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bosch Divar Ip 2000 Firmware | <3.62.0019 | |
| Bosch DIVAR IP 2000 | ||
| Bosch Divar Ip 5000 Firmware | <3.80.0033 | |
| Bosch DIVAR IP 5000 | ||
| Bosch Video Management System | <3.71.0032 | |
| Bosch Video Recording Manager | <3.71.0032 | |
| Bosch Video Recording Manager | >=3.81<3.81.0032 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2019-8952.
What is the severity of CVE-2019-8952?
The severity of CVE-2019-8952 is medium with a severity value of 6.5.
Which Bosch hardware and software products are affected by CVE-2019-8952?
Bosch DIVAR IP 2000 Firmware versions up to 3.62.0019 and Bosch Divar IP 5000 Firmware versions up to 3.80.0033 are affected. The Bosch Video Management System and Bosch Video Recording Manager versions up to 3.71.0032 are also affected.
How does CVE-2019-8952 affect the affected Bosch hardware and software products?
CVE-2019-8952 allows a remote authorized user to access arbitrary files on the system via the network interface.
How can I fix CVE-2019-8952?
Apply the latest firmware updates provided by Bosch for the affected products to address CVE-2019-8952.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/bosch
- canonical/bosch divar ip 2000 firmware
- canonical/bosch divar ip 2000
- canonical/bosch divar ip 5000 firmware
- canonical/bosch divar ip 5000
- canonical/bosch video management system
- canonical/bosch video recording manager
- version/bosch video recording manager/3.81