CVE-2019-6957

Published: May 29, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager (VRM), Video Streaming Gateway (VSG), Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The vulnerability potentially allows the unauthorized execution of code in the system via the network interface.

Affected (21)

Products: Bosch: Access Professional Edition, Bosch Video Client, Bosch Video Management System, Building Integration System, Configuration Manager, Video Recording Manager, Video Sdk, Video Streaming Gateway, Dip 2000 Firmware, Dip 3000 Firmware, Dip 5000 Firmware, Dip 7000 Firmware, Access Easy Controller Firmware

Bosch

13 products

Access Professional Edition

Bosch Video Client

Bosch Video Management System

Building Integration System

Configuration Manager

Video Recording Manager

Video Sdk

Video Streaming Gateway

Access Easy Controller Firmware

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Bosch Access Professional Edition	From 3.0 to 3.7
Bosch Bosch Video Client	Before 1.7.6.079
Bosch Bosch Video Management System	Up to 9.0
Bosch Building Integration System	From 2.2 to 4.4
Bosch Building Integration System	Version 4.5
Bosch Building Integration System	Version 4.6.1
Bosch Building Integration System	Version 4.6
Bosch Configuration Manager	Before 6.10
Bosch Video Recording Manager	Before 3.71.0032
Bosch Video Recording Manager	From 3.81 to 3.81.0048
Bosch Video Sdk	Before 6.32.0099
Bosch Video Streaming Gateway	Before 6.43.0023
Bosch Video Streaming Gateway	From 6.45 to 6.45.0008

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Bosch Dip 2000 Firmware	Before 0380.037

Running on/with	Platform Versions
Bosch Dip 2000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Bosch Dip 3000 Firmware	All versions

Running on/with	Platform Versions
Bosch Dip 3000	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Bosch Dip 5000 Firmware	Before 038.037

Running on/with	Platform Versions
Bosch Dip 5000	All versions

Configuration E

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Bosch Dip 7000 Firmware	All versions

Running on/with	Platform Versions
Bosch Dip 7000	Version gen1
Bosch Dip 7000	Version gen2

Configuration F

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Bosch Access Easy Controller Firmware	Version 2.1.8.5
Bosch Access Easy Controller Firmware	Version 2.1.9.0
Bosch Access Easy Controller Firmware	Version 2.1.9.1
Bosch Access Easy Controller Firmware	Version 2.1.9.3

Running on/with	Platform Versions
Bosch Access Easy Controller	All versions

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0403bt-cve-2019-6957_security_advisory_software_buffer_overflow.pdf

Source: cve@mitre.org

Vendor Advisory

https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0403bt-cve-2019-6957_security_advisory_software_buffer_overflow.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.