{ "id": "CVE-2023-35867", "sourceIdentifier": "psirt@bosch.com", "published": "2023-12-18T13:15:07.010", "lastModified": "2024-11-21T08:08:51.793", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { "lang": "en", "value": "An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks." }, { "lang": "es", "value": "Un manejo inadecuado de paquetes de respuesta API con formato incorrecto para clientes API en productos de software Bosch BT puede permitir que un atacante no autenticado provoque una situaci\u00f3n de denegaci\u00f3n de servicio (DoS). Para aprovechar esta vulnerabilidad, un atacante debe reemplazar un servidor API existente, por ejemplo mediante ataques Man-in-the-Middle." } ], "metrics": { "cvssMetricV31": [ { "source": "psirt@bosch.com", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 2.2, "impactScore": 3.6 }, { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 2.2, "impactScore": 3.6 } ] }, "weaknesses": [ { "source": "psirt@bosch.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-703" } ] }, { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "NVD-CWE-Other" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:building_integration_system_video_engine:*:*:*:*:*:*:*:*", "versionEndIncluding": "5.0.1", "matchCriteriaId": "F28540F2-5651-4443-8B98-F3880609FDF4" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:bosch_video_management_system:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "E174ECD4-2F81-4F4D-81D5-2D6449E776C5" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "DEF983D4-76C3-4B0B-B5D4-38B382817827" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:configuration_manager:*:*:*:*:*:*:*:*", "versionEndIncluding": "7.62", "matchCriteriaId": "B63F7045-9EA4-4ACA-851C-DF1D6B444022" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:bosch:divar_ip_7000_r2_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "CBE6F03E-7671-45D3-9C9F-19112D8422D2" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C27C0C9-7FC8-4B0C-BBF1-C7833CA9B2DE" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_4000_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "1E2F28D9-444C-4FE8-8129-57A65397380D" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_4000:-:*:*:*:*:*:*:*", "matchCriteriaId": "058E1EC6-5D7E-4AA4-AC6F-B235753AF06F" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_5000_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "D3475E4D-0F6A-4D7E-A667-F3B90F679535" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "7075A014-A297-4E41-81D8-2535BC2BD4E9" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_6000_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "6F70C23B-1262-458A-89DA-56C767D23E46" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_6000:-:*:*:*:*:*:*:*", "matchCriteriaId": "56136987-D034-4001-9D91-86205EA42C82" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_7000_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "40AE6FA0-24E1-4E16-BF04-FF267769C090" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_7000:-:*:*:*:*:*:*:*", "matchCriteriaId": "E531FC6E-B7AF-48DF-ACC2-91B5BD2B68DB" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_7000_r3_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "12.0", "matchCriteriaId": "1F993333-427F-4EA8-B509-63324D40C272" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_7000_r3:-:*:*:*:*:*:*:*", "matchCriteriaId": "5AF06298-9397-4111-9660-637A7A4484FA" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:intelligent_insights:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.0.3.14", "matchCriteriaId": "DC6B338D-31A4-4192-936A-CD462112822F" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:_onvif_camera_event_driver_tool:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.0.0.8", "matchCriteriaId": "8169AFEE-532B-4A40-B7E5-D1E8BDF29FF5" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:project_assistant:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.3", "matchCriteriaId": "39DB5F35-7309-4B50-817B-6DD03AC64A91" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:bosch:video_security_client:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.3.5", "matchCriteriaId": "2C32C11F-D04D-4CE1-A8A4-68D5DF11F041" } ] } ] } ], "references": [ { "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html", "source": "psirt@bosch.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ] } ] }