CVE-2020-6790 in Video Streaming Gateway
Summary
by MITRE
Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious exe in the same directory where the installer is started from.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/05/2021
The vulnerability identified as CVE-2020-6790 represents a critical security flaw in the Bosch Video Streaming Gateway installer software, affecting versions up to and including 6.45.10. This issue falls under the category of uncontrolled search path elements, a common weakness that exploits how applications resolve file paths during execution. The vulnerability stems from the installer's improper handling of the system's search path when executing binaries, creating an opportunity for privilege escalation through malicious code injection. The flaw operates by leveraging the predictable execution flow of the installer process, which may inadvertently execute malicious executables placed in the same directory where the installer is invoked. This type of vulnerability is particularly dangerous because it requires minimal user interaction beyond the initial installation process, making it a prime target for social engineering attacks.
The technical implementation of this vulnerability exploits the Windows operating system's path resolution mechanism, where the system searches for executables in a predefined order of directories. When the Bosch installer runs, it may inadvertently execute a malicious file with the same name as a legitimate component, especially if the malicious file is placed in the working directory from which the installer is launched. This behavior directly aligns with CWE-426, which describes the weakness of allowing untrusted code to be executed with elevated privileges. The vulnerability is particularly concerning because it operates at the installer level, where the software typically runs with elevated privileges, potentially enabling attackers to gain system-level access. Attackers can leverage this by placing a malicious executable in the same directory as the installer, creating a scenario where the installer's execution path is manipulated to run the attacker's code instead of the intended legitimate components.
The operational impact of this vulnerability extends beyond simple code execution, as it can lead to full system compromise and persistent access within victim environments. Once executed, the malicious code can establish backdoors, exfiltrate sensitive data, or deploy additional malware payloads, making this a significant threat to enterprise security infrastructure. The vulnerability's exploitation requires minimal technical expertise from attackers, as it relies on social engineering to trick users into executing the malicious installer from a compromised directory. This makes it particularly dangerous in enterprise environments where users may be less security-aware, and where the installer might be run from shared or temporary directories. The attack vector is particularly relevant in contexts where the Bosch Video Streaming Gateway is deployed in security-critical environments such as surveillance systems, industrial control systems, or network monitoring infrastructure, where unauthorized access could lead to significant operational disruptions or data breaches.
Mitigation strategies for CVE-2020-6790 should focus on both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities. The most effective immediate solution is to upgrade to a patched version of the Bosch Video Streaming Gateway installer, which addresses the uncontrolled search path issue by implementing proper path validation and execution controls. Organizations should also implement strict directory permissions and access controls, ensuring that installation directories are not writable by unprivileged users. Additionally, security awareness training should be implemented to educate users about the dangers of executing installers from untrusted directories. From a defensive perspective, the vulnerability's characteristics align with ATT&CK technique T1059.001 for command and scripting interpreter, as it enables arbitrary code execution through legitimate system processes. Network segmentation and application whitelisting can further mitigate the risk by preventing unauthorized executables from being placed in installation directories. The fix should also incorporate proper input validation and path resolution techniques that prevent the installer from executing files from arbitrary locations, thereby eliminating the attack surface that enables this vulnerability.