CVE-2019-11684 Improper Access Control in Bosch Video Recording Manager
Unauthenticated attackers can access a limited subset of certificates from the Bosch Video Recording Manager server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11684?
CVE-2019-11684 is a critical missing authorization vulnerability in n/a, published on 26 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
Weakness: CWE-306
Which versions are affected by CVE-2019-11684?
It affects 3 products.
Products include Bosch Divar Ip 5000 Firmware, Bosch Video Management System, Bosch Video Recording Manager.
How do I fix CVE-2019-11684?
No fix has been published for CVE-2019-11684 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-11684 being exploited?
There is no known exploitation of CVE-2019-11684 in the wild and no public exploit code.
Sources
Also known as GHSA-xj63-5v6j-3xr7.