2023-12-18 17:00:28 +00:00
{
"id" : "CVE-2023-35867" ,
"sourceIdentifier" : "psirt@bosch.com" ,
"published" : "2023-12-18T13:15:07.010" ,
2023-12-22 21:00:28 +00:00
"lastModified" : "2023-12-22T20:13:40.507" ,
"vulnStatus" : "Analyzed" ,
2023-12-18 17:00:28 +00:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks."
2023-12-22 21:00:28 +00:00
} ,
{
"lang" : "es" ,
"value" : "Un manejo inadecuado de paquetes de respuesta API con formato incorrecto para clientes API en productos de software Bosch BT puede permitir que un atacante no autenticado provoque una situaci\u00f3n de denegaci\u00f3n de servicio (DoS). Para aprovechar esta vulnerabilidad, un atacante debe reemplazar un servidor API existente, por ejemplo mediante ataques Man-in-the-Middle."
2023-12-18 17:00:28 +00:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
2023-12-22 21:00:28 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 5.9 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.2 ,
"impactScore" : 3.6
} ,
2023-12-18 17:00:28 +00:00
{
"source" : "psirt@bosch.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 5.9 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.2 ,
"impactScore" : 3.6
}
]
} ,
"weaknesses" : [
2023-12-22 21:00:28 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "NVD-CWE-Other"
}
]
} ,
2023-12-18 17:00:28 +00:00
{
"source" : "psirt@bosch.com" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-703"
}
]
}
] ,
2023-12-22 21:00:28 +00:00
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:building_integration_system_video_engine:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "5.0.1" ,
"matchCriteriaId" : "F28540F2-5651-4443-8B98-F3880609FDF4"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:bosch_video_management_system:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "E174ECD4-2F81-4F4D-81D5-2D6449E776C5"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "DEF983D4-76C3-4B0B-B5D4-38B382817827"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:configuration_manager:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "7.62" ,
"matchCriteriaId" : "B63F7045-9EA4-4ACA-851C-DF1D6B444022"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:bosch:divar_ip_7000_r2_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "CBE6F03E-7671-45D3-9C9F-19112D8422D2"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7C27C0C9-7FC8-4B0C-BBF1-C7833CA9B2DE"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:bosch:divar_ip_all-in-one_4000_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "1E2F28D9-444C-4FE8-8129-57A65397380D"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:bosch:divar_ip_all-in-one_4000:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "058E1EC6-5D7E-4AA4-AC6F-B235753AF06F"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:bosch:divar_ip_all-in-one_5000_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "D3475E4D-0F6A-4D7E-A667-F3B90F679535"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7075A014-A297-4E41-81D8-2535BC2BD4E9"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:bosch:divar_ip_all-in-one_6000_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "6F70C23B-1262-458A-89DA-56C767D23E46"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:bosch:divar_ip_all-in-one_6000:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "56136987-D034-4001-9D91-86205EA42C82"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:bosch:divar_ip_all-in-one_7000_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "40AE6FA0-24E1-4E16-BF04-FF267769C090"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:bosch:divar_ip_all-in-one_7000:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E531FC6E-B7AF-48DF-ACC2-91B5BD2B68DB"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:bosch:divar_ip_all-in-one_7000_r3_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "12.0" ,
"matchCriteriaId" : "1F993333-427F-4EA8-B509-63324D40C272"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:bosch:divar_ip_all-in-one_7000_r3:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5AF06298-9397-4111-9660-637A7A4484FA"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:intelligent_insights:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "1.0.3.14" ,
"matchCriteriaId" : "DC6B338D-31A4-4192-936A-CD462112822F"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:_onvif_camera_event_driver_tool:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2.0.0.8" ,
"matchCriteriaId" : "8169AFEE-532B-4A40-B7E5-D1E8BDF29FF5"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:project_assistant:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2.3" ,
"matchCriteriaId" : "39DB5F35-7309-4B50-817B-6DD03AC64A91"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:bosch:video_security_client:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "3.3.5" ,
"matchCriteriaId" : "2C32C11F-D04D-4CE1-A8A4-68D5DF11F041"
}
]
}
]
}
] ,
2023-12-18 17:00:28 +00:00
"references" : [
{
"url" : "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html" ,
2023-12-22 21:00:28 +00:00
"source" : "psirt@bosch.com" ,
"tags" : [
"Vendor Advisory"
]
2023-12-18 17:00:28 +00:00
}
]
}
