CVE-2023-35867: Bosch BVMS, логическа грешка

Описание

Оригинално описание

An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.

Засегнати продукти

• Bosch BVMS: до 12.0.0
• Bosch BVMS Viewer: до 12.0.0
• Bosch Configuration Manager: до 7.62
• Bosch DIVAR IP 7000 R2: до 12.0.0
• Bosch DIVAR IP all-in-one 5000: до 12.0.0
• Bosch DIVAR IP all-in-one 7000: до 12.0.0
• Bosch DIVAR IP all-in-one 7000 R3: до 12.0.0
• Bosch DIVAR IP all-in-one 4000: до 12.0.0
• Bosch DIVAR IP all-in-one 6000: до 12.0.0
• Bosch Project Assistant: до 2.3
• Bosch Video Security Client: до 3.3.5
• Bosch BIS Video Engine: до 5.0.1
• Bosch Intelligent Insights: до 1.0.3.14
• Bosch ONVIF Camera Event Driver Tool: до 2.0.0.8

Вид слабост

• CWE-703 Improper Check or Handling of Exceptional Conditions

История

Други уязвимости в Bosch BVMS

• 7.5CVE-2024-33618
• 7.1CVE-2023-28175
• 7.4CVE-2022-32540
• 7.2CVE-2021-23862
• 6.5CVE-2021-23861

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-35867
• https://nvd.nist.gov/vuln/detail/CVE-2023-35867
• https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html