CVE-2020-6785: Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer
First published: Thu Mar 25 2021(Updated: )
Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This also affects Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 and Bosch DIVAR IP all-in-one 7000 with installers and installed BVMS versions prior to BVMS 10.1.1.
Credit: psirt@bosch.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bosch Video Management System | <9.0 | |
| Bosch Video Management System | >=10.0<10.0.2 | |
| Bosch Video Management System | >=10.1<10.1.1 | |
| Bosch DIVAR IP 7000 R2 | ||
| Bosch DIVAR IP all-in-one 5000 | ||
| Bosch DIVAR IP all-in-one 7000 | ||
| Bosch Video Management System Viewer | <9.0 | |
| Bosch Video Management System Viewer | >=10.0<10.0.2 | |
| Bosch Video Management System Viewer | >=10.1.0<10.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2020-6785?
CVE-2020-6785 is a vulnerability in Bosch BVMS and BVMS Viewer that allows an attacker to execute arbitrary code on a victim's system.
Which versions of Bosch BVMS and BVMS Viewer are affected by CVE-2020-6785?
Versions 10.1.0, 10.0.1, 10.0.0, and 9.0.0 and older of Bosch BVMS and BVMS Viewer are affected by CVE-2020-6785.
How severe is CVE-2020-6785?
CVE-2020-6785 has a severity score of 7.8, which is considered high.
How can an attacker exploit CVE-2020-6785?
An attacker can exploit CVE-2020-6785 by loading a DLL through an uncontrolled search path element in Bosch BVMS and BVMS Viewer.
Is there a fix available for CVE-2020-6785?
There is currently no information available on a fix for CVE-2020-6785. It is recommended to follow the vendor's security advisory for updates.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/bosch
- canonical/bosch video management system
- version/bosch video management system/10.0
- version/bosch video management system/10.1
- canonical/bosch divar ip 7000 r2
- canonical/bosch divar ip all-in-one 5000
- canonical/bosch divar ip all-in-one 7000
- canonical/bosch video management system viewer
- version/bosch video management system viewer/10.0
- version/bosch video management system viewer/10.1.0