Bosch DIVAR IP 2000/DIVAR IP 5000 prior 3.10 Webserver path traversal

Summaryinfo

A vulnerability was found in Bosch DIVAR IP 2000 and DIVAR IP 5000. It has been classified as critical. This impacts an unknown function of the component Webserver. This manipulation causes path traversal. This vulnerability is handled as CVE-2019-8952. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Bosch DIVAR IP 2000 and DIVAR IP 5000 and classified as critical. Affected by this vulnerability is an unknown code block of the component Webserver. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032).

The bug was discovered 04/03/2019. The weakness was released 05/13/2019 (Website). It is possible to read the advisory at media.boschsecurity.com. This vulnerability is known as CVE-2019-8952 since 02/20/2019. The attack can be launched remotely. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 40 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3.10 eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-134670. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Bosch

Name

• DIVAR IP 2000
• DIVAR IP 5000

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion