An improper handling of a malformed API answer packets to API clients in Bosch BT…
Priority LOW 27CWE-703Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
Why it matters now
EPSS 0.00556 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bosch | BVMS | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | BVMS Viewer | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | Configuration Manager | up to 7.62 | — | No fix listed | CNA |
| Bosch | DIVAR IP 7000 R2 | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | DIVAR IP all-in-one 5000 | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | DIVAR IP all-in-one 7000 | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | DIVAR IP all-in-one 7000 R3 | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | DIVAR IP all-in-one 4000 | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | DIVAR IP all-in-one 6000 | up to 12.0.0 | — | No fix listed | CNA |
| Bosch | Project Assistant | up to 2.3 | — | No fix listed | CNA |
| Bosch | Video Security Client | up to 3.3.5 | — | No fix listed | CNA |
| Bosch | BIS Video Engine | up to 5.0.1 | — | No fix listed | CNA |
| Bosch | Intelligent Insights | up to 1.0.3.14 | — | No fix listed | CNA |
| Bosch | ONVIF Camera Event Driver Tool | up to 2.0.0.8 | — | No fix listed | CNA |
- BVMS VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- BVMS Viewer VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- Configuration Manager VendorBosch Affected up to 7.62 Fixed in — No fix listed CNA
- DIVAR IP 7000 R2 VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- DIVAR IP all-in-one 5000 VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- DIVAR IP all-in-one 7000 VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- DIVAR IP all-in-one 7000 R3 VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- DIVAR IP all-in-one 4000 VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- DIVAR IP all-in-one 6000 VendorBosch Affected up to 12.0.0 Fixed in — No fix listed CNA
- Project Assistant VendorBosch Affected up to 2.3 Fixed in — No fix listed CNA
- Video Security Client VendorBosch Affected up to 3.3.5 Fixed in — No fix listed CNA
- BIS Video Engine VendorBosch Affected up to 5.0.1 Fixed in — No fix listed CNA
- Intelligent Insights VendorBosch Affected up to 1.0.3.14 Fixed in — No fix listed CNA
- ONVIF Camera Event Driver Tool VendorBosch Affected up to 2.0.0.8 Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bosch:building_integration_system_video_engine:*:*:*:*:*:*:*:* | up to 5.0.1 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:bosch_video_management_system:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:configuration_manager:*:*:*:*:*:*:*:* | up to 7.62 | Vulnerable | Bosch |
| cpe:2.3:o:bosch:divar_ip_7000_r2_firmware:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:o:bosch:divar_ip_all-in-one_4000_firmware:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:divar_ip_all-in-one_4000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:o:bosch:divar_ip_all-in-one_5000_firmware:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
- cpe:2.3:a:bosch:building_integration_system_video_engine:*:*:*:*:*:*:*:* Versions up to 5.0.1 Vulnerable ·Bosch
- cpe:2.3:a:bosch:bosch_video_management_system:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:a:bosch:configuration_manager:*:*:*:*:*:*:*:* Versions up to 7.62 Vulnerable ·Bosch
- cpe:2.3:o:bosch:divar_ip_7000_r2_firmware:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:h:bosch:divar_ip_7000_r2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:o:bosch:divar_ip_all-in-one_4000_firmware:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:h:bosch:divar_ip_all-in-one_4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:o:bosch:divar_ip_all-in-one_5000_firmware:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bosch:divar_ip_all-in-one_6000_firmware:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:divar_ip_all-in-one_6000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:o:bosch:divar_ip_all-in-one_7000_firmware:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:divar_ip_all-in-one_7000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:o:bosch:divar_ip_all-in-one_7000_r3_firmware:*:*:*:*:*:*:*:* | up to 12.0 | Vulnerable | Bosch |
| cpe:2.3:h:bosch:divar_ip_all-in-one_7000_r3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bosch |
| cpe:2.3:a:bosch:intelligent_insights:*:*:*:*:*:*:*:* | up to 1.0.3.14 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:_onvif_camera_event_driver_tool:*:*:*:*:*:*:*:* | up to 2.0.0.8 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:project_assistant:*:*:*:*:*:*:*:* | up to 2.3 | Vulnerable | Bosch |
| cpe:2.3:a:bosch:video_security_client:*:*:*:*:*:*:*:* | up to 3.3.5 | Vulnerable | Bosch |
- cpe:2.3:o:bosch:divar_ip_all-in-one_6000_firmware:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:h:bosch:divar_ip_all-in-one_6000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:o:bosch:divar_ip_all-in-one_7000_firmware:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:h:bosch:divar_ip_all-in-one_7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:o:bosch:divar_ip_all-in-one_7000_r3_firmware:*:*:*:*:*:*:*:* Versions up to 12.0 Vulnerable ·Bosch
- cpe:2.3:h:bosch:divar_ip_all-in-one_7000_r3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bosch
- cpe:2.3:a:bosch:intelligent_insights:*:*:*:*:*:*:*:* Versions up to 1.0.3.14 Vulnerable ·Bosch
- cpe:2.3:a:bosch:_onvif_camera_event_driver_tool:*:*:*:*:*:*:*:* Versions up to 2.0.0.8 Vulnerable ·Bosch
- cpe:2.3:a:bosch:project_assistant:*:*:*:*:*:*:*:* Versions up to 2.3 Vulnerable ·Bosch
- cpe:2.3:a:bosch:video_security_client:*:*:*:*:*:*:*:* Versions up to 3.3.5 Vulnerable ·Bosch
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-35867
- 2026-10-03 Alias added: GHSA-hj54-qg34-2jrm
References
Sources
- CVE-2023-35867 · CVE Program
- CVE-2023-35867 · NVD
- FIRST EPSS
- GHSA-hj54-qg34-2jrm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences