CVE-2019-11684 - CVE House
Back to Database
Status published Critical CVE-2019-11684

Improper Access Control in Bosch Video Recording Manager

Vulnerability Description

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11684

Credits & Attribution

No credits recorded in the NVD database.

References

More from bosch

View All →
CVE-2021-23863
HTML code injection vulnerability in Android Application, Bosch Video Security,...
Medium 6.1
CVE-2019-8952
A Path Traversal vulnerability located in the webserver affects several...
Medium 6.5
CVE-2019-8951
An Open Redirect vulnerability located in the webserver affects several...
Medium 6.1
CVE-2019-7729
An issue was discovered in the Bosch Smart Camera App...
Low 3.3
CVE-2019-7728
An issue was discovered in the Bosch Smart Camera App...
High 7.5

Affected Vendor

Affected Software

video recording manager, divar ip 5000 firmware, video management system
Vulnerable Versions:
3.70, 3.81, 3.80, 3.70.0056, 3.70.0058, 3.70.0060, 3.70.0062, 3.71.0022, 3.71.0029, 3.71.0031, 3.71.0032, 3.81.0032, 3.81.0038, 3.81.0048

Timeline

Official Publish: February 26th, 2021
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.