CVE-2022-32540: Infoleak
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-32540?
CVE-2022-32540 is a vulnerability that allows a man-in-the-middle attacker to compromise confidential video streams in the Operator Client application in BVMS 10.1.1, 11.0, and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30.
How does CVE-2022-32540 affect the Bosch Video Management System (BVMS)?
CVE-2022-32540 affects BVMS versions 10.1.1, 11.0, and 11.1.0, allowing a man-in-the-middle attacker to compromise confidential video streams when UDP encryption is used.
Which systems are affected by CVE-2022-32540?
BVMS versions 10.1.1, 11.0, and 11.1.0, as well as VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30, are affected by CVE-2022-32540.
What is the severity of CVE-2022-32540?
CVE-2022-32540 has a severity rating of 5.9 (High).
Is there a fix available for CVE-2022-32540?
Yes, Bosch has released a security advisory with instructions on how to mitigate this vulnerability. Please refer to the following link: [Bosch Security Advisory](https://psirt.bosch.com/security-advisories/bosch-sa-464066.html).