high7.2
CVE-2021-23862
A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context.
Impact
A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bosch | Bosch Video Management System | through 9.0 from 10.0 before 10.0.2 Versions 10.1, 11.0 |
| Bosch | Video Recording Manager | through 3.81 from 3.82 through 3.82.0057 from 3.83 through 3.83.0021 from 4.0 through 4.00.0070 |
| Bosch | Videojet Decoder 7513 Firmware | through 10.22.0038 |
| Bosch | Videojet Decoder 8000 Firmware | through 10.01.0036 |