What’s Vulnerable › Vulnerabilities

CVE-2023-28175

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-15 · updated 2026-06-17
• Weakness: CWE-200

Description

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.

Affected products

• Bosch Divar Ip 3000 Firmware: from 7.5 through 8.0
• Bosch Divar Ip 4000 Firmware: 11.1.1
• Bosch Divar Ip 5000 Firmware: from 9.0 through 11.1.1
• Bosch Divar Ip 6000 Firmware: 11.1.1
• Bosch Divar Ip 7000 Firmware: from 7.5 through 8.0
• Bosch Divar Ip 7000 R2 Firmware: from 7.5 through 11.1.1
• Bosch Divar Ip 7000 R3 Firmware: from 10.1.1 through 11.1.1
• Bosch Video Management System: from 7.5 through 11.1.1
• Bosch Video Management System Viewer: from 7.5 through 11.1.1

References

• https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html
• https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html

Get alerted when CVE-2023-28175 or the next vulnerability affects your stack