title: Uncontrolled Search Path Element in Bosch Video Recording Manager Installer
description: Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
problem types: CWE-427 Uncontrolled Search Path Element
affected:
{
product: Video Recording Manager
vendor: Bosch
versions:
status: affected, version: 3.71 and older all
lessThanOrEqual: 3.82.0055, status: affected, version: 3.82, versionType: custom
lessThanOrEqual: 3.81.0064, status: affected, version: 3.81, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]