title: Possible Access to Debug Functions in Bosch VRM / BVMS
description: By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
problem types: CWE-489 Active Debug Code
affected:
{
product: BVMS
vendor: Bosch
versions:
lessThanOrEqual: 9.0.0, status: affected, version: unspecified, versionType: custom
lessThan: 11.0.0, status: affected, version: 11.0, versionType: custom
lessThan: 10.0.2, status: affected, version: 10.0, versionType: custom
lessThan: 10.1.1, status: affected, version: 10.1, versionType: custom
}
{
product: DIVAR IP 7000 R2
vendor: Bosch
versions:
status: affected, version: all
}
{
product: DIVAR IP all-in-one 5000
vendor: Bosch
versions:
status: affected, version: all
}
{
product: DIVAR IP all-in-one 7000
vendor: Bosch
versions:
status: affected, version: all
}
{
product: VRM
vendor: Bosch
versions:
lessThanOrEqual: 3.81, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 4.00.0070, status: affected, version: 4.0, versionType: custom
lessThanOrEqual: 3.83.0021, status: affected, version: 3.83, versionType: custom
lessThanOrEqual: 3.82.0057, status: affected, version: 3.82, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
]