Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer
Priority LOW 34CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This also affects Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 and Bosch DIVAR IP all-in-one 7000 with installers and installed BVMS versions prior to BVMS 10.1.1.
Why it matters now
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed BVMS (Bosch): 9.0.0, 10.0.2, 10.1.1BVMS Viewer (Bosch): 9.0.0, 10.0.2, 10.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bosch | BVMS | before 9.0.0; 10.0 to before 10.0.2; 10.1 to before 10.1.1 | 9.0.0, 10.0.2, 10.1.1 | Patch available | CNA |
| Bosch | BVMS Viewer | before 9.0.0; 10.0 to before 10.0.2; 10.1 to before 10.1.1 | 9.0.0, 10.0.2, 10.1.1 | Patch available | CNA |
| Bosch | DIVAR IP 7000 R2 | all | — | No fix listed | CNA |
| Bosch | DIVAR IP all-in-one 5000 | all | — | No fix listed | CNA |
| Bosch | DIVAR IP all-in-one 7000 | all | — | No fix listed | CNA |
- BVMS VendorBosch Affected before 9.0.0; 10.0 to before 10.0.2; 10.1 to before 10.1.1 Fixed in 9.0.0, 10.0.2, 10.1.1 Patch available CNA
- BVMS Viewer VendorBosch Affected before 9.0.0; 10.0 to before 10.0.2; 10.1 to before 10.1.1 Fixed in 9.0.0, 10.0.2, 10.1.1 Patch available CNA
- DIVAR IP 7000 R2 VendorBosch Affected all Fixed in — No fix listed CNA
- DIVAR IP all-in-one 5000 VendorBosch Affected all Fixed in — No fix listed CNA
- DIVAR IP all-in-one 7000 VendorBosch Affected all Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:* | before 9.0; 10.0 to before 10.0.2; 10.1 to before 10.1.1 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:h:bosch:divar_ip_all-in-one_7000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:* | before 9.0; 10.0 to before 10.0.2; 10.1.0 to before 10.1.1 | Vulnerable | Bosch |
- cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:* Versions before 9.0; 10.0 to before 10.0.2; 10.1 to before 10.1.1 Vulnerable ·Bosch
- cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:h:bosch:divar_ip_all-in-one_7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:* Versions before 9.0; 10.0 to before 10.0.2; 10.1.0 to before 10.1.1 Vulnerable ·Bosch
Remediation
- Fix · CNA BVMS (Bosch) Fixed in 9.0.0, 10.0.2, 10.1.1
- Fix · CNA BVMS Viewer (Bosch) Fixed in 9.0.0, 10.0.2, 10.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6785
- 2026-10-03 Alias added: GHSA-vp6p-847f-22m3
References
More Bosch Video Management System vulnerabilities
- TI-2019-08746 Improper Access Control in Bosch Video Recording Manager CVSS 3.1CRITICAL 9.9
- TI-2020-05486 Path Traversal in Bosch Video Management System (BVMS) CVSS 3.1HIGH 8.6
- TI-2020-05485 Path Traversal in Bosch Video Management System (BVMS) CVSS 3.1HIGH 7.7
- TI-2023-12744 Information disclosure in Bosch BVMS CVSS 3.1HIGH 7.7
- TI-2019-06461 A Path Traversal vulnerability located in the webserver affects several Bosch hardware… CVSS 3.0MEDIUM 6.5
- TI-2019-06460 An Open Redirect vulnerability located in the webserver affects several Bosch hardware… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2020-6785 · CVE Program
- CVE-2020-6785 · NVD
- FIRST EPSS
- GHSA-vp6p-847f-22m3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences