PT-2021-15575 · Bosch · Divar Ip+3

Published 2021-12-08 · Updated 2022-08-30 · CVE-2021-23862

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: BVMS with VRM installed versions (affected versions not specified) DIVAR IP versions (affected versions not specified) VIDEOJET decoder versions (affected versions not specified) VRM versions (affected versions not specified)

Description: A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue affects installations of various products, including the VRM, DIVAR IP, BVMS with VRM installed, and the VIDEOJET decoder.

Recommendations: For BVMS with VRM installed, consider disabling the functionality that allows configuration packets to be sent by authenticated administrative users until a patch is available. For DIVAR IP, restrict access to the system context to minimize the risk of exploitation. For VIDEOJET decoder, avoid using the device until the issue is resolved. For VRM, consider implementing additional security measures to prevent arbitrary command execution in system context. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

CVE-2021-23862

Affected Products

Bvms

Divar Ip

Videojet Decoder

Vrm

References · 5

• https://osv.dev/vulnerability/CVE-2021-23862 · Vendor Advisory
• https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23862 · Security Note
• https://t.me/cvenotify/35450 · Telegram Post
• https://t.me/cibsecurity/33659 · Telegram Post