Improper Check or Handling of Exceptional Conditions in Robert Bosch products - CVE-2023-35867

Vulnerability identifier: #VU84932

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-35867

CWE-ID: CWE-703

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of a malformed API answer packets to API clients. A remote attacker can replace an existing API server and cause a denial of service condition.

Bosch BIS Video Engine
Bosch DIVAR IP all-in-one 7000 R3
Bosch DIVAR IP all-in-one 7000
Bosch Intelligent Insights
Bosch DIVAR IP all-in-one 6000
Bosch DIVAR IP all-in-one 5000
Bosch ONVIF Camera Event Driver Tool
Bosch DIVAR IP all-in-one 4000
Bosch DIVAR IP 7000 R2
Bosch Project Assistant
Bosch Configuration Manager
Bosch BVMS Viewer
Bosch Video Security Client
Bosch BVMS

Install updates from vendor's website.

Bosch DIVAR IP all-in-one 7000 R3 - update to 12.0.1
Bosch DIVAR IP all-in-one 7000 - update to 12.0.1
Bosch Intelligent Insights - update to 1.0.3.22
Bosch DIVAR IP all-in-one 6000 - update to 12.0.1
Bosch DIVAR IP all-in-one 5000 - update to 12.0.1
Bosch ONVIF Camera Event Driver Tool - update to 2.1.1.4
Bosch DIVAR IP all-in-one 4000 - update to 12.0.1
Bosch DIVAR IP 7000 R2 - update to 12.0.1
Bosch Project Assistant - update to 2.4.0.36
Bosch Configuration Manager - update to 7.70.0090
Bosch BVMS Viewer - update to 12.0.1
Bosch Video Security Client - update to 3.4.0.42
Bosch BVMS - update to 12.0.1

• https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html

• Multiple vulnerabilities in Bosch BT software products