PT-2021-8900 · Microsoft+1 · Windows+3

Published 2021-02-26 · Updated 2021-07-21 · CVE-2019-11684

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bosch Video Recording Manager (VRM) versions 3.70.x through 3.71.0033 Bosch Video Recording Manager (VRM) versions 3.71.0034 through 3.80.0038 are not affected, however versions 3.81 through 3.81.0049 DIVAR IP 5000 versions 3.80 through 3.80.0038 BVMS versions using VRM (affected versions not specified)

Description The issue is related to improper access control in the RCP+ server, allowing arbitrary and unauthenticated access to a limited subset of certificates stored in the Microsoft Windows operating system. The fixed versions implement modified authentication checks.

Recommendations For Bosch Video Recording Manager (VRM) versions 3.70.x through 3.71.0033, update to version 3.71.0034 or later. For Bosch Video Recording Manager (VRM) versions 3.81 through 3.81.0049, update to version 3.81.0050 or later. For DIVAR IP 5000 versions 3.80 through 3.80.0038, update to version 3.80.0039 or later. For BVMS using VRM, ensure the underlying VRM version is updated to a fixed version.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-11684

Affected Products

Bvms

Bosch Video Recording Manager

Divar Ip 5000

Windows

References · 4

• https://osv.dev/vulnerability/CVE-2019-11684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11684 · Security Note
• https://psirt.bosch.com/security-advisories/bosch-sa-804652.html · Vendor Advisory
• https://t.me/cibsecurity/24219 · Telegram Post