Search
Find a vulnerability
Search criteria
3 vulnerabilities found for DIVAR IP all-in-one 4000 by Bosch
CVE-2024-33618 (GCVE-0-2024-33618)
Vulnerability from cvelistv5 – Published: 2026-04-15 09:51 – Updated: 2026-04-15 13:09
VLAI
EPSS
VEX
Summary
Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1
allows attackers to consume excessive amounts of disk space via network interface.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 13:09 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.bosch.com/security-advisories/BOSCH… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Bosch | BVMS |
Affected:
6.0 , ≤ 12.0.1
(custom)
|
|
| Bosch | BVMS Viewer |
Affected:
8.0 , ≤ 12.0.1
(custom)
|
|
| Bosch | Bosch DIVAR IP all-in-one 7000 R3 |
Affected:
10.1 , ≤ 12.0.1
(custom)
|
|
| Bosch | Bosch DIVAR IP 7000 R2 |
Affected:
9.0 , ≤ 12.0.1
(custom)
|
|
| Bosch | Bosch DIVAR IP all-in-one 5000 |
Affected:
9.0 , ≤ 12.0.1
(custom)
|
|
| Bosch | Bosch DIVAR IP all-in-one 7000 |
Affected:
6.0 , ≤ 12.0.1
(custom)
|
|
| Bosch | DIVAR IP all-in-one 4000 |
Affected:
11.1.1 , ≤ 12.0.1
(custom)
|
|
| Bosch | DIVAR IP all-in-one 6000 |
Affected:
11.1.1 , ≤ 12.0.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33618",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T13:09:08.201665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T13:09:13.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BVMS",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"product": "BVMS Viewer",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP all-in-one 7000 R3",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "10.1",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP 7000 R2",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP all-in-one 7000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 4000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "11.1.1",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 6000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.1",
"status": "affected",
"version": "11.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 \r\nallows attackers to consume excessive amounts of disk space via network interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T09:51:52.722Z",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-162032-BT.html",
"tags": [
"vendor-advisory"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-162032-BT.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2024-33618",
"datePublished": "2026-04-15T09:51:52.722Z",
"dateReserved": "2024-06-17T09:19:04.535Z",
"dateUpdated": "2026-04-15T13:09:13.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-35867 (GCVE-0-2023-35867)
Vulnerability from cvelistv5 – Published: 2023-12-18 12:59 – Updated: 2024-08-02 16:30
VLAI
EPSS
VEX
Summary
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
Severity
5.9 (Medium)
CWE
- CWE-703 - Improper Check or Handling of Exceptional Conditions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.bosch.com/security-advisories/BOSCH… | vendor-advisory |
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Bosch | BVMS |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | BVMS Viewer |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | Configuration Manager |
Affected:
0 , ≤ 7.62
(custom)
|
|
| Bosch | DIVAR IP 7000 R2 |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | DIVAR IP all-in-one 5000 |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | DIVAR IP all-in-one 7000 |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | DIVAR IP all-in-one 7000 R3 |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | DIVAR IP all-in-one 4000 |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | DIVAR IP all-in-one 6000 |
Affected:
0 , ≤ 12.0.0
(custom)
|
|
| Bosch | Project Assistant |
Affected:
0 , ≤ 2.3
(custom)
|
|
| Bosch | Video Security Client |
Affected:
0 , ≤ 3.3.5
(custom)
|
|
| Bosch | BIS Video Engine |
Affected:
0 , ≤ 5.0.1
(custom)
|
|
| Bosch | Intelligent Insights |
Affected:
0 , ≤ 1.0.3.14
(custom)
|
|
| Bosch | ONVIF Camera Event Driver Tool |
Affected:
0 , ≤ 2.0.0.8
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:30:45.391Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BVMS",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "BVMS Viewer",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "Configuration Manager",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "7.62",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP 7000 R2",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 7000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 7000 R3",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 4000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 6000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "Project Assistant",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "2.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "Video Security Client",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "3.3.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "BIS Video Engine",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "5.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "Intelligent Insights",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "1.0.3.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "ONVIF Camera Event Driver Tool",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "2.0.0.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703 Improper Check or Handling of Exceptional Conditions",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-18T12:59:48.604Z",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html",
"tags": [
"vendor-advisory"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2023-35867",
"datePublished": "2023-12-18T12:59:48.604Z",
"dateReserved": "2023-06-19T09:15:32.387Z",
"dateUpdated": "2024-08-02T16:30:45.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28175 (GCVE-0-2023-28175)
Vulnerability from cvelistv5 – Published: 2023-06-15 10:14 – Updated: 2024-12-17 20:51
VLAI
EPSS
VEX
Summary
Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-17 20:49 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.bosch.com/security-advisories/BOSCH… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Bosch | BVMS |
Affected:
7.5 , ≤ 11.1.1
(custom)
|
|
| Bosch | BVMS Viewer |
Affected:
7.5 , ≤ 11.1.1
(custom)
|
|
| Bosch | Bosch DIVAR IP 3000 |
Affected:
7.5 , ≤ 8.0
(custom)
|
|
| Bosch | Bosch DIVAR IP 7000 R1 |
Affected:
7.5 , ≤ 8.0
(custom)
|
|
| Bosch | Bosch DIVAR IP 7000 R2 |
Affected:
7.5 , ≤ 11.1.1
(custom)
|
|
| Bosch | Bosch DIVAR IP all-in-one 7000 R3 |
Affected:
10.1.1 , ≤ 11.1.1
(custom)
|
|
| Bosch | Bosch DIVAR IP all-in-one 5000 |
Affected:
9.0 , ≤ 11.1.1
(custom)
|
|
| Bosch | Bosch DIVAR IP all-in-one 7000 |
Affected:
9.0 , ≤ 11.1.1
(custom)
|
|
| Bosch | DIVAR IP all-in-one 4000 |
Affected:
11.1.1
|
|
| Bosch | DIVAR IP all-in-one 6000 |
Affected:
11.1.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.180Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28175",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T20:49:39.796592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T20:51:14.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BVMS",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "11.1.1",
"status": "affected",
"version": "7.5",
"versionType": "custom"
}
]
},
{
"product": "BVMS Viewer",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "11.1.1",
"status": "affected",
"version": "7.5",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP 3000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.0",
"status": "affected",
"version": "7.5",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP 7000 R1",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "8.0",
"status": "affected",
"version": "7.5",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP 7000 R2",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "11.1.1",
"status": "affected",
"version": "7.5",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP all-in-one 7000 R3",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "11.1.1",
"status": "affected",
"version": "10.1.1",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP all-in-one 5000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "11.1.1",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
},
{
"product": "Bosch DIVAR IP all-in-one 7000",
"vendor": "Bosch",
"versions": [
{
"lessThanOrEqual": "11.1.1",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
},
{
"product": "DIVAR IP all-in-one 4000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "11.1.1"
}
]
},
{
"product": "DIVAR IP all-in-one 6000",
"vendor": "Bosch",
"versions": [
{
"status": "affected",
"version": "11.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-15T10:14:34.076Z",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html",
"tags": [
"vendor-advisory"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2023-28175",
"datePublished": "2023-06-15T10:14:34.076Z",
"dateReserved": "2023-03-13T15:46:37.814Z",
"dateUpdated": "2024-12-17T20:51:14.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}