CVE-2020-6768: 
Bosch Video Management System (BVMS) vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2020-6768) was discovered in the Bosch Video Management System (BVMS) NoTouch deployment. The vulnerability was identified during internal security tests and disclosed on January 29, 2020. This security flaw affects multiple versions of Bosch BVMS and BVMS Viewer (versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329, and 7.5 and older), as well as Bosch DIVAR IP 3000, DIVAR IP 7000, and DIVAR IP all-in-one 5000 systems with vulnerable BVMS versions installed (Bosch Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and received a CVSS v3.1 Base Score of 8.6 (High). The attack vector is network-based, requiring low complexity and no authentication or user interaction. The vulnerability exists in the BVMS service, affecting the entire file system of the server operating system where BVMS server is running. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (Bosch Advisory, NVD).

If exploited, an unauthenticated attacker without local shell access to a BVMS Central Server system can fetch arbitrary data from the file system of the Central Server computer. Under specific circumstances, the attack can also be executed from the internet, potentially leading to critical confidentiality impacts (Bosch Advisory).

Bosch recommends updating to fixed software versions as the primary mitigation strategy. If immediate updates aren't possible, temporary workarounds include deactivating the BVMS NoTouch deployment service via the Central Server application configuration file. Additionally, devices should not be exposed directly to the internet or other insecure networks. Specific patches are available for different versions: BVMS10001225_Patch_SecurityIssue_211404_241463.zip for version 10.0, BVMS900827_Patch_SecurityIssue_211404_241463.zip for version 9.0, and BVMS800329_Patch_SecurityIssue_211404_241463.zip for version 8.0 (Bosch Advisory).