CVE-2023-35867

{"id": "CVE-2023-35867", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "psirt@bosch.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2023-12-18T13:15:07.010", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html", "tags": ["Vendor Advisory"], "source": "psirt@bosch.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "psirt@bosch.com", "description": [{"lang": "en", "value": "CWE-703"}]}], "descriptions": [{"lang": "en", "value": "An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks."}, {"lang": "es", "value": "Un manejo inadecuado de paquetes de respuesta API con formato incorrecto para clientes API en productos de software Bosch BT puede permitir que un atacante no autenticado provoque una situaci\u00f3n de denegaci\u00f3n de servicio (DoS). Para aprovechar esta vulnerabilidad, un atacante debe reemplazar un servidor API existente, por ejemplo mediante ataques Man-in-the-Middle."}], "lastModified": "2023-12-22T20:13:40.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:building_integration_system_video_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F28540F2-5651-4443-8B98-F3880609FDF4", "versionEndIncluding": "5.0.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:bosch_video_management_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E174ECD4-2F81-4F4D-81D5-2D6449E776C5", "versionEndIncluding": "12.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEF983D4-76C3-4B0B-B5D4-38B382817827", "versionEndIncluding": "12.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:configuration_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B63F7045-9EA4-4ACA-851C-DF1D6B444022", "versionEndIncluding": "7.62"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:divar_ip_7000_r2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBE6F03E-7671-45D3-9C9F-19112D8422D2", "versionEndIncluding": "12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7C27C0C9-7FC8-4B0C-BBF1-C7833CA9B2DE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_4000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E2F28D9-444C-4FE8-8129-57A65397380D", "versionEndIncluding": "12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_4000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "058E1EC6-5D7E-4AA4-AC6F-B235753AF06F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3475E4D-0F6A-4D7E-A667-F3B90F679535", "versionEndIncluding": "12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7075A014-A297-4E41-81D8-2535BC2BD4E9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_6000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F70C23B-1262-458A-89DA-56C767D23E46", "versionEndIncluding": "12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_6000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "56136987-D034-4001-9D91-86205EA42C82"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_7000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40AE6FA0-24E1-4E16-BF04-FF267769C090", "versionEndIncluding": "12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_7000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E531FC6E-B7AF-48DF-ACC2-91B5BD2B68DB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:divar_ip_all-in-one_7000_r3_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F993333-427F-4EA8-B509-63324D40C272", "versionEndIncluding": "12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:divar_ip_all-in-one_7000_r3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5AF06298-9397-4111-9660-637A7A4484FA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:intelligent_insights:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC6B338D-31A4-4192-936A-CD462112822F", "versionEndIncluding": "1.0.3.14"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:_onvif_camera_event_driver_tool:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8169AFEE-532B-4A40-B7E5-D1E8BDF29FF5", "versionEndIncluding": "2.0.0.8"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:project_assistant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39DB5F35-7309-4B50-817B-6DD03AC64A91", "versionEndIncluding": "2.3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bosch:video_security_client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C32C11F-D04D-4CE1-A8A4-68D5DF11F041", "versionEndIncluding": "3.3.5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@bosch.com"}