title: Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service
description: Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
product: DIVAR IP 3000
vendor: Bosch
versions:
status: affected, version: All
}
{
product: DIVAR IP 7000
vendor: Bosch
versions:
status: affected, version: All
}
{
product: BVMS Mobile Video Service
vendor: Bosch
versions:
lessThanOrEqual: 8.0.0.329, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 9.0.0.827, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 10.0.0.1225, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 7.5, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]