CVE-2023-28175: Infoleak
Published Jun 15, 2023
·Updated
Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.
Affected Software
16 affected components
Bosch Video Management System>=7.5<=11.1.1
Bosch Video Management System Viewer>=7.5<=11.1.1
Bosch Divar Ip 4000
Bosch DIVAR IP 5000
Bosch Divar Ip 6000
Bosch DIVAR IP 7000
Bosch DIVAR IP 7000 R2
Bosch Divar Ip 7000 R3
Bosch Divar Ip 3000 Firmware>=7.5<=8.0
Bosch DIVAR IP 3000
Bosch Divar Ip 6000 Firmware=11.1.1
Bosch Divar Ip 4000 Firmware=11.1.1
Bosch Divar Ip 5000 Firmware>=9.0<=11.1.1
Bosch Divar Ip 7000 R2 Firmware>=7.5<=11.1.1
Bosch Divar Ip 7000 Firmware>=7.5<=8.0
Bosch Divar Ip 7000 R3 Firmware>=10.1.1<=11.1.1
Event History
Jun 15, 2023
CVE Published
via MITRE·10:14 AM
Data Sourced
via MITRE·10:14 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID for this security flaw?
The vulnerability ID is CVE-2023-28175.
2
What is the severity level of CVE-2023-28175?
CVE-2023-28175 has a severity level of 7.7 (high).
3
What is the affected software?
The affected software includes Bosch Video Management System versions 11.0, 11.1.0, and 11.1.1, and Bosch Video Management System Viewer versions 11.0, 11.1.0, and 11.1.1.
4
What can a remote authenticated user do through this vulnerability?
A remote authenticated user can access resources within the trusted internal network via a port forwarding request.
5
Where can I find more information about this vulnerability?
More information about CVE-2023-28175 can be found at the following link: [Bosch Security Advisory](https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html).