CVE-2020-6786 - CVE House

Back to Database

Status published High CVE-2020-6786

Uncontrolled Search Path Element in Bosch Video Recording Manager Installer

7.8 CVSS

Vulnerability Description

Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-6786

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html

More from Bosch

View All →

Enabling SSH server on Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Affected Vendor

Bosch

View all reports →

Affected Software

Video Recording Manager

Vulnerable Versions:

3.71 and older all, 3.82, 3.81

Timeline

Official Publish: March 25th, 2021

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

T1574.001 DLL Search Order Hijacking

Privilege Escalation

T1547 Boot or Logon Autostart Execution

T1036 Masquerading

Defense Evasion

T1059 Command and Scripting Interpreter