Unrestricted SSH port forwarding in BVMS

Advisory Information

• Advisory ID: BOSCH-SA-025794-BT
• CVE Numbers and CVSS v3.1 Scores:
  • CVE-2023-28175
    • Base Score: 7.1 (High)
• Published: 24 May 2023
• Last Updated: 24 May 2023

Summary

The Bosch Video Management System is using SSH server that does not restrict a port forwarding requested by an authenticated SSH client. An authenticated SSH client can request a connection which is forwarded by the BVMS SSH server to a resource within the trusted internal network, which is normally protected from the WAN interface. The resource can be beyond the scope of the Bosch Video Management System.

Affected Products

• Bosch BVMS
  • CVE-2023-28175
    • Version(s): 7.5 - 11.1.1 (including)
• Bosch BVMS Viewer
  • CVE-2023-28175
    • Version(s): 7.5 - 11.1.1 (including)
• Bosch DIVAR IP 3000
  • CVE-2023-28175
    • Version(s): 7.5 - 8.0 (including)
• Bosch DIVAR IP 7000 R1
  • CVE-2023-28175
    • Version(s): 7.5 - 8.0 (including)
• Bosch DIVAR IP 7000 R2
  • CVE-2023-28175
    • Version(s): 7.5 - 11.1.1 (including)
• Bosch DIVAR IP all-in-one 5000
  • CVE-2023-28175
    • Version(s): 9.0 - 11.1.1 (including)
• Bosch DIVAR IP all-in-one 7000
  • CVE-2023-28175
    • Version(s): 9.0 - 11.1.1 (including)
• Bosch DIVAR IP all-in-one 7000 R3
  • CVE-2023-28175
    • Version(s): 10.1.1 - 11.1.1 (including)
• Bosch DIVAR IP all-in-one 4000
  • CVE-2023-28175
    • Version(s): 11.1.1
• Bosch DIVAR IP all-in-one 6000
  • CVE-2023-28175
    • Version(s): 11.1.1

Solution and Mitigations

Software Updates

The recommended approach is to update the software to a fixed version as soon as possible. Please check the Appendix for a list of updated versions for each affected product.

Secure Network Resources

It is advised to secure network infrastructure to prevent the BVMS SSH server from accessing resources that do not belong to the BVMS system. Network administrators should implement the following recommendations in conjunction with laws, regulations, and industry best practices:

• Segment and segregate networks.

• Harden BVMS SSH host by turning off unnecessary services.

• Monitor the network and review logs.

• Validate hardware integrity.

Vulnerability Details

CVE-2023-28175

CVE description: Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.

• Problem Type:
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
  • Base Score: 7.1 (High)

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

• [1] BVMS Download Area: https://downloadstore.boschsecurity.com/index.php?type=BVMS
• [2] BVMS Viewer Download Area: https://downloadstore.boschsecurity.com/index.php?type=BVMSVWR
• [3] BVMS Appliances (DIVAR IP) Download Area: https://downloadstore.boschsecurity.com/?type=DIPBVMS

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

• 24 May 2023: Initial Publication

Appendix

Fixes for the Affected Products

BVMS

BVMS Download Area

BVMS Viewer

BVMS Viewer Download Area

Bosch DIVAR IP all-in-one 7000 R3

BVMS Appliances Download Area

Bosch DIVAR IP 7000 R2

BVMS Download Area

Bosch DIVAR IP all-in-one 5000

BVMS Download Area

Bosch DIVAR IP all-in-one 7000

BVMS Download Area

DIVAR IP all-in-one 4000

BVMS Appliances Download Area

DIVAR IP all-in-one 6000

BVMS Appliances Download Area

Material Lists

BVMS

Bosch DIVAR IP 7000 R2

Bosch DIVAR IP all-in-one 5000

Bosch DIVAR IP all-in-one 7000

DIVAR IP all-in-one 7000 R3

DIVAR IP all-in-one 4000

DIVAR IP all-in-one 6000