Denial of Service vulnerability in Bosch BT software products

Advisory Information

• Advisory ID: BOSCH-SA-092656-BT
• CVE Numbers and CVSS v3.1 Scores:
  • CVE-2023-32230
    • Base Score: 7.5 (High)
  • CVE-2023-35867
    • Base Score: 5.9 (Medium)
• Published: 13 Dec 2023
• Last Updated: 13 Dec 2023

Summary

An security vulnerability discovered in Bosch internal tests allows an unauthenticated attacker to interrupt normal functions and cause a Denial of Service / DoS.

Bosch rates this vulnerability with a CVSSv3.1 base scores of 7.5 (High) for products using the vulnerable function as a server and 5.9 (medium) for products using the vulnerable function as a client, where the actual rating depends on the individual vulnerability and the final rating on the customer’s environment.

Customers are strongly advised to update to the fixed versions.

Affected Products

• Bosch BIS Video Engine
  • CVE-2023-35867
    • Version(s): <= 5.0.1
• Bosch BVMS
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch BVMS Viewer
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch Configuration Manager
  • CVE-2023-35867
    • Version(s): <= 7.62
• Bosch DIVAR IP 7000 R2
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch DIVAR IP all-in-one 4000
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch DIVAR IP all-in-one 5000
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch DIVAR IP all-in-one 6000
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch DIVAR IP all-in-one 7000
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch DIVAR IP all-in-one 7000 R3
  • CVE-2023-35867
    • Version(s): <= 12.0.0
• Bosch Intelligent Insights
  • CVE-2023-35867
    • Version(s): <= 1.0.3.14
• Bosch Monitorwall
  • CVE-2023-32230
    • Version(s): <= 10.00.0164
• Bosch ONVIF Camera Event Driver Tool
  • CVE-2023-35867
    • Version(s): <= 2.0.0.8
• Bosch Project Assistant
  • CVE-2023-35867
    • Version(s): <= 2.3
• Bosch VJD-7513
  • CVE-2023-32230
    • Version(s): <= 10.40.0055
• Bosch VJD-7523
  • CVE-2023-32230
    • Version(s): <= 10.40.0055
• Bosch Video Recording Manager
  • CVE-2023-32230
    • Version(s): <= 04.10.0079
• Bosch Video Security Client
  • CVE-2023-35867
    • Version(s): <= 3.3.5
• Bosch Video Streaming Gateway
  • CVE-2023-32230
    • Version(s): <= 8.1.2.2
    • Version(s): 9.0.0 - 9.0.0.178 (including)

Solution and Mitigations

Software Updates

The recommended approach is to update the affected Bosch software to a fixed version. If an update is not possible in timely manner, users are recommended to follow the mitigation described in the following section.

A reboot or restart of the affected component is needed after applying the patch.

After installing the patch it should be verified if the patch was applied by checking the version of the updated component.

Firewalling

Disallowing connections from insecure networks to the affected software and devices by means of a firewall prevents the attacker from accessing the vulnerable interface.

Vulnerability Details

CVE-2023-32230

CVE description: An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation.

• Problem Type:
  • CWE-703 Improper Check or Handling of Exceptional Conditions
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Base Score: 7.5 (High)

CVE-2023-35867

CVE description: An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.

• Problem Type:
  • CWE-703 Improper Check or Handling of Exceptional Conditions
• CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Base Score: 5.9 (Medium)

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

• [1] Software Updates: https://downloadstore.boschsecurity.com
• [2] BIS Download Area: https://downloadstore.boschsecurity.com/index.php?type=BIS
• [3] BVMS Download Area: https://downloadstore.boschsecurity.com/index.php?type=BVMS
• [4] BVMS Appliances (DIVAR IP) Download Area: https://downloadstore.boschsecurity.com/?type=DIPBVMS
• [5] VRM Download Area: https://downloadstore.boschsecurity.com/index.php?type=VRM
• [6] VJD Download Area: https://downloadstore.boschsecurity.com/index.php?type=DEC
• [7] VSC Download Area: https://downloadstore.boschsecurity.com/index.php?type=VSW8
• [8] PA Download Area: https://downloadstore.boschsecurity.com/index.php?type=COMAPPW

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

• 13 Dec 2023: Initial Publication

Appendix

Fixes for the Affected Products

Material Lists

BIS Video Engine

BVMS

Configuration Manager

DIVAR IP 7000 R2

DIVAR IP all-in-one 5000

DIVAR IP all-in-one 7000

DIVAR IP all-in-one 7000 R3

DIVAR IP all-in-one 4000

DIVAR IP all-in-one 6000

Intelligent Insights

Monitor Wall

Project Assistant

Video Security Client

VIDEOJET decoder 7000 (VJD-7000)

Video Recording Manager (VRM)