.NET Remote Code Execution Vulnerability in BVMS, BIS and AMS

Advisory Information

• Advisory ID: BOSCH-SA-110112-BT
• CVE Numbers and CVSS v3.1 Scores:
  • CVE-2021-26701
    • Base Score: 9.8 (Critical)
• Published: 24 May 2023
• Last Updated: 24 May 2023

Summary

The Bosch Video Management System (BVMS), the Bosch Access Management System (AMS), and the Bosch Building Integration System (BIS) are using a vulnerable version of the Microsoft .NET package System.Text.Encodings.Web. The System.Text.Encodings.Web is a NuGet package from Microsoft, and Microsoft has published an advisory to provide information about a vulnerability in System.Text.Encodings.Web.

A remote code execution vulnerability exists in System.Text.Encodings.Web due to how text encoding is performed.

Affected Products

• Bosch AMS
  • CVE-2021-26701
    • Version(s): <= 5.0
• Bosch BIS
  • CVE-2021-26701
    • Version(s): <= 4.9.2
• Bosch BVMS
  • CVE-2021-26701
    • Version(s): > 11.0
    • Version(s): <= 11.1.1
• Bosch BVMS Viewer
  • CVE-2021-26701
    • Version(s): > 11.0
    • Version(s): <= 11.1.1
• Bosch DIVAR IP 7000 R2
  • CVE-2021-26701
    • Version(s): > 11.0
    • Version(s): <= 11.1.1
• Bosch DIVAR IP all-in-one 5000
  • CVE-2021-26701
    • Version(s): > 11.0
    • Version(s): <= 11.1.1
• Bosch DIVAR IP all-in-one 7000
  • CVE-2021-26701
    • Version(s): > 11.0
    • Version(s): <= 11.1.1
• Bosch DIVAR IP all-in-one 7000 R3
  • CVE-2021-26701
    • Version(s): > 11.0
    • Version(s): <= 11.1.1
• Bosch DIVAR IP all-in-one 4000
  • CVE-2021-26701
    • Version(s): 11.1.1
• Bosch DIVAR IP all-in-one 6000
  • CVE-2021-26701
    • Version(s): 11.1.1

Solution and Mitigations

Software Updates

The recommended approach is to update the software to a fixed version as soon as possible. Please check the Appendix for a list of updated versions for each affected product.

Mitigation

Bosch has not identified any mitigating factors for this vulnerability.

Vulnerability Details

CVE-2021-26701

CVE description: .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

• Problem Type:
  • CWE-94 Improper Control of Generation of Code
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Base Score: 9.8 (Critical)

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

• [1] BVMS Download Area: https://downloadstore.boschsecurity.com/index.php?type=BVMS
• [2] BVMS Viewer Download Area: https://downloadstore.boschsecurity.com/index.php?type=BVMSVWR
• [3] BVMS Appliances (DIVAR IP) Download Area: https://downloadstore.boschsecurity.com/?type=DIPBVMS
• [4] AMS Download Area: https://downloadstore.boschsecurity.com/?type=AMS
• [5] BIS Download Area: https://downloadstore.boschsecurity.com/?type=BIS
• [6] Security Advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28
• [7] CVE: https://nvd.nist.gov/vuln/detail/CVE-2021-26701

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

• 24 May 2023: Initial Publication

Appendix

Fixes for the Affected Products

BVMS

BVMS Download Area

BVMS Viewer

BVMS Viewer Download Area

Bosch DIVAR IP all-in-one 7000 R3

BVMS Appliances Download Area

Bosch DIVAR IP 7000 R2

BVMS Download Area

Bosch DIVAR IP all-in-one 5000

BVMS Download Area

Bosch DIVAR IP all-in-one 7000

BVMS Download Area

DIVAR IP all-in-one 4000

BVMS Appliances Download Area

DIVAR IP all-in-one 6000

BVMS Appliances Download Area

Access Management System (AMS)

Building Integration System (BIS)

Material Lists

BVMS

Bosch DIVAR IP 7000 R2

Bosch DIVAR IP all-in-one 5000

Bosch DIVAR IP all-in-one 7000

DIVAR IP all-in-one 7000 R3

DIVAR IP all-in-one 4000

DIVAR IP all-in-one 6000

Access Management System (AMS)

Building Integration System (BIS)