CVE-2019-11684: 
Bosch Video Recording Manager (VRM) vulnerability analysis and mitigation

The CVE-2019-11684 is a vulnerability affecting the RCP+ server of the Bosch Video Recording Manager (VRM) component. The vulnerability was discovered during internal product tests and disclosed on May 9, 2019. It affects VRM versions v3.70.x, v3.71 < v3.71.0034, v3.81 < 3.81.0050, DIVAR IP 5000 3.80 < 3.80.0039, and all versions of BVMS using VRM (Bosch Advisory).

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and received a CVSS v3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability allows arbitrary and unauthenticated access to a limited subset of certificates stored in the underlying Microsoft Windows operating system's certificate store (NVD, Bosch Advisory).

The vulnerability potentially allows unauthenticated access to a limited subset of certificates stored in the operating system's certificate store. The vulnerability is exploitable via the network interface and has been rated as Critical with a CVSSv3 score of 9.9 (Bosch Advisory).

As of May 9th, 2019, there was no indication that the vulnerability was either publicly known or being exploited in the wild. The vulnerability is exploitable through network access, requiring no authentication or user interaction (Bosch Advisory).

Bosch recommends updating vulnerable components to fixed software versions. If immediate updates are not possible, mitigation measures include: reducing network exposure, implementing firewalls to prevent direct internet exposure, and utilizing IP filtering features. Systems should not be exposed directly to the internet, and port forwarding should be avoided. For shared environments, internal IP filters of BVMS Systems can be activated to whitelist specific IPs and IP-ranges (Bosch Advisory).