CVE-2019-6958 - CVE House
Back to Database
Status published Critical CVE-2019-6958

Improper Access Control for Bosch Video Systems, PSIM and Access Control Systems

Vulnerability Description

A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The RCP+ network port allows access without authentication. Adding authentication feature to the respective library fixes the issue. The issue is classified as "CWE-284: Improper Access Control." This vulnerability, for example, allows a potential attacker to delete video or read video data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-6958

Credits & Attribution

No credits recorded in the NVD database.

References

More from bosch

View All →
CVE-2021-23863
HTML code injection vulnerability in Android Application, Bosch Video Security,...
Medium 6.1
CVE-2019-8952
A Path Traversal vulnerability located in the webserver affects several...
Medium 6.5
CVE-2019-8951
An Open Redirect vulnerability located in the webserver affects several...
Medium 6.1
CVE-2019-7729
An issue was discovered in the Bosch Smart Camera App...
Low 3.3
CVE-2019-7728
An issue was discovered in the Bosch Smart Camera App...
High 7.5

Affected Vendor

Affected Software

access professional edition, bosch video client, bosch video management system, building integration system, configuration manager, video sdk, dip 2000 firmware, dip 3000 firmware, dip 5000 firmware, dip 7000 firmware, access easy controller firmware
Vulnerable Versions:
3.0, 0, 2.2, 4.5, 4.6, 4.6.1, 2.1.8.5, 2.1.9.0, 2.1.9.1, 2.1.9.3

Timeline

Official Publish: May 29th, 2019
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.