vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-6767

Path Traversal in Bosch Video Management System (BVMS)

MEDIUM
6.5
CVSS Score
Published: February 6, 2020 at 04:19 PM UTC
Updated: June 17, 2026 at 03:23 AM UTC
6 products affected across 1 vendorVideo Management SystemVideo Management System ViewerDivar Ip 3000

Using DIVAR IP 3000 by Bosch?

Get instant alerts when new vulnerabilities affect DIVAR IP 3000 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 1%

Description

A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Video Management System· Bosch
95%
v ≤ 10.0.0.1225v ≤ 7.0v ≤ 7.5v ≤ 8.0.0.329v ≤ 9.0.0.82710.0 ≤ v ≤ 10.0.0.12258.0 ≤ v ≤ 8.0.0.3299.0 ≤ v ≤ 9.0.0.827
bosch-divar-ip-3000 (environment) · bosch-divar-ip-7000 (environment) · bosch-divar-ip-all-in-one-5000 (environment)
Video Management System Viewer· Bosch
95%
v ≤ 10.0.0.1225v ≤ 7.0v ≤ 7.5v ≤ 8.0.0.329v ≤ 9.0.0.82710.0 ≤ v ≤ 10.0.0.12258.0 ≤ v ≤ 8.0.3299.0 ≤ v ≤ 9.0.0.827
Divar IP 3000 Firmware· Bosch
60%
3000
DIVAR IP 7000· Bosch
60%
All versions
DIVAR IP all-in-one 5000· Bosch
60%
All versions
Divar Ip 3000· Boschdevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

x_refsource_CONFIRMBroken LinkVendor Advisory
Source: [email protected]
https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.html
PatchVendor Advisory
Source: [email protected]
https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-sa-381489-bt_cve-2020-6767_securityadvisory_bvms_pathtraversal.pdf

CVSS

6.5MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card