CVE-2020-6790 - CVE House

Back to Database

Status published High CVE-2020-6790

Uncontrolled Search Path Element in Bosch Video Streaming Gateway Installer

7.8 CVSS

Vulnerability Description

Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious exe in the same directory where the installer is started from.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-6790

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Dhiraj Mishra

References

https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html

More from Bosch

View All →

Enabling SSH server on Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Affected Vendor

Bosch

View all reports →

Affected Software

Video Streaming Gateway

Vulnerable Versions:

unspecified

Timeline

Official Publish: March 25th, 2021

Last Modified: September 17th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

T1574.001 DLL Search Order Hijacking

Privilege Escalation

T1547 Boot or Logon Autostart Execution

T1036 Masquerading

Defense Evasion

T1059 Command and Scripting Interpreter