CVE-2021-23860: 
Bosch Video Recording Manager (VRM) vulnerability analysis and mitigation

An error in a page handler of the VRM (Video Recording Manager) was discovered that leads to a reflected cross-site scripting (XSS) vulnerability in the web-based interface. The vulnerability, identified as CVE-2021-23860, was disclosed on December 8, 2021. This vulnerability affects multiple Bosch products including VRM, DIVAR IP, and Bosch Video Management System (BVMS) with VRM installed. To exploit this vulnerability, an attacker must be able to modify the HTTP header that is sent (Bosch Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). According to the CVSS v3.1 scoring system, this vulnerability has been assigned a base score of 5.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. The scoring indicates that while the vulnerability is network-accessible, it requires high attack complexity and user interaction to exploit (NVD, Bosch Advisory).

The vulnerability could potentially allow an attacker to execute cross-site scripting attacks through the web-based interface, potentially leading to unauthorized access to sensitive information, session hijacking, or other web-based attacks. The CVSS scoring indicates low potential impact on confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires specific conditions to be exploited: the attacker must be able to modify the HTTP header that is sent to the application. The attack complexity is considered high, and user interaction is required for successful exploitation. No public exploits have been reported in the wild (Bosch Advisory).

Bosch has released security updates to address this vulnerability across multiple affected products. Users are strongly advised to update to the fixed versions. For BVMS, updates are available up to version 11.0.0.1025, for VRM up to version 4.01.0012, and for various DIVAR IP models. If immediate updates are not possible, network access controls and proper firewall configurations should be implemented to restrict access to the web-based interface (Bosch Advisory).