Lucene search

BoschCVE-2020-6786

HistoryMar 25, 2021 - 4:15 p.m.

CVE-2020-6786

2021-03-2516:15:13

CWE-427

bosch

web.nvd.nist.gov

cve-2020-6786

information security

vulnerability

dll

uncontrolled search path

bosch video recording manager

nvd

arbitrary code execution

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

31.4%

JSON

Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execute arbitrary code on a victim’s system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.

Affected configurations

Nvd

Node

boschvideo_recording_managerRange≤3.71

boschvideo_recording_managerRange3.81–3.81.0064

boschvideo_recording_managerRange3.82–3.82.0055

VendorProductVersionCPE
boschvideo_recording_manager*cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bosch	video_recording_manager	*	cpe:2.3:a:bosch:video_recording_manager::::::::

CNA Affected

[
  {
    "product": "Video Recording Manager",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "3.71 and older all"
      },
      {
        "lessThanOrEqual": "3.82.0055",
        "status": "affected",
        "version": "3.82",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.81.0064",
        "status": "affected",
        "version": "3.81",
        "versionType": "custom"
      }
    ]
  }
]

References

psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

31.4%

JSON

Related for CVE-2020-6786