Information Disclosure in VIDEOJET Decoder and Operator Client application in BVMS

Advisory Information

• Advisory ID: BOSCH-SA-464066-BT
• CVE Numbers and CVSS v3.1 Scores:
  • CVE-2022-32540
    • Base Score: 7.4 (High)
• Published: 21 Sep 2022
• Last Updated: 21 Sep 2022

Summary

BVMS Operator Client application or the VIDEOJET Decoder VJD-7513 may receive an unencrypted live-stream from a camera which allows a man-in-the-middle attacker to compromise the confidential video streams.

This happens only in combination with cameras of platform CPP13 or CPP14.x when encrypted UDP connection is configured. Please be aware that encrypted UDP connection is default setting  («Secure Connection» setting) for all cameras added into BVMS.

Decoders used in BVMS system are only affected when BVMS version is higher or equal to 10.1.0 as older BVMS versions do not support UDP connection between camera and decoder. Standalone decoders are only affected, when the Secure flag and UDP multicast is selected for camera streams.

For more details please see the description of the vulnerability in this advisory.

Bosch rates this vulnerability with CVSSv3.1 base score 7.4 (High), where the final rating depends on the customer’s environment.

Customers are strongly advised to update the software to the fixed versions or consider listed mitigations.

Affected Products

• Bosch BVMS 10.1 <= 10.1.1
• Bosch BVMS 11.0 <= 11.0.0
• Bosch BVMS 11.1 <= 11.1.0
• Bosch VJD-7513 10.23.0002
• Bosch VJD-7513 10.30.0005

Solution and Mitigations

Software Updates

The recommended approach is to update the affected Bosch software and hardware firmware to fixed versions. Please refer to appendix for list of affected versions and available updates.

A reboot is required after applying the update to BVMS. To check whether the update has been successfully applied, please check the version in Configuration Client or Operator Client menu «Help» -> «About...» -> «Version».

If the update is not applicable in a target environment, users are recommended to follow the mitigations described in the following section.

Update Operator Client Only

In case the whole BVMS system cannot be updated to the latest version, it is sufficient to update the Operator Client workstations to version 11.1.1 that is fixing this issue and ensuring backwards compatibility. The Update of the Operator Client has to be done on each machine manually as there is no automatic deployment from central BVMS Central Server.

Use TCP Encryption instead of UDP

When software update is not possible, customers are advised to configure their BVMS systems to use TCP protocol:

• For cameras using workstation settings in Configuration Client. This will force TCP protocol for all cameras, even if they are not affected by the vulnerability described in this advisory.

• For cameras using camera specific context menu in Operator Client to enable TCP protocol for affected cameras only. This is one-time action that has to be made per camera for each BVMS user.

• For decoders using Decoder settings dialog in Configuration Client to use TCP video stream.

To learn more about configuring TCP settings in BVMS Configuration Client see BVMS Configuration Manual:

• Chapter «Workstation Page» -> «Settings Page» (12.7.5)

• Chapter «Edit Encoder/ Edit Decoder Page» (12.8.2)

To learn more about configuring TCP settings in BVMS Operator Client see BVMS Operation Manual:

• Chapter «Using TCP for reliable connection» (6.33)

In case TCP encryption is not feasible in customers environment due to the number of cameras, customers are advised to contact Customer Support.

Secure Network from Unauthorized Access

It is advised to secure network infrastructure devices including routers, firewalls, switches and prevent unauthorized actors from being able to monitor, modify and deny traffic to and from devices and services inside the customer network. Network administrators should implement following recommendations in conjunction with laws, regulations and industry best practices:

• Segment and segregate networks.

• Harden network management devices by testing patches, turning off unnecessary services on routers and switches, and enforcing strong password policies.

• Monitor the network and review logs.

• Validate integrity of hardware.

Vulnerability Details

CVE-2022-32540

CVE description: Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream.

This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.

• Problem Type:
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CVSS Vector String: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  • Base Score: 7.4 (High)

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

• [1] BVMS Download Area: https://downloadstore.boschsecurity.com/index.php?type=BVMS
• [2] BVMS Viewer Download Area: https://downloadstore.boschsecurity.com/index.php?type=BVMSVWR
• [3] BVMS Appliances (DIVAR IP) Download Area: https://downloadstore.boschsecurity.com/?type=DIPBVMS
• [4] VJD Download Area: https://downloadstore.boschsecurity.com/?type=DEC

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

• 21 Sep 2022: Initial Publication

Appendix

Affected Products

BVMS

BVMS Download Area

BVMS Viewer

BVMS Viewer Download Area

Bosch DIVAR IP all-in-one 7000 R3

BVMS Appliances Download Area

Bosch DIVAR IP 7000 R2

BVMS Download Area

Bosch DIVAR IP all-in-one 5000

BVMS Download Area

Bosch DIVAR IP all-in-one 7000

BVMS Download Area

Bosch VIDEOJET Decoder VJD-7513

VIDEOJET Decoder Download Area

Material Lists

BVMS

Bosch DIVAR IP 7000 R2

Bosch DIVAR IP all-in-one 5000

Bosch DIVAR IP all-in-one 7000

DIVAR IP all-in-one 7000 R3

VJD-7513