CVE-2019-8951
Bosch
- Published
- 13 May 2019
- Last modified
- 17 June 2026
- CVSS
- 6.1 v3.0
- Severity
- medium
- EPSS
- 1.1% (63th pct)
- CISA KEV
- Not listed
- NVD status
- Modified
- Weaknesses
- CWE-601
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote attacker to redirect users to an arbitrary URL. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.70.0056 and newer; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; fixed versions: 7.5; 3.70.0056).
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. The catalogue records confirmed public exploitation. Absence from it does not establish that exploitation has not occurred. EPSS models a 1.1% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| Divar IP 2000 | Bosch | unknown | < 3.62.0019, <= 3.62.0019 |
| Divar IP 5000 | Bosch | unknown | < 3.80.0033, < 3.80.0039, <= 11.1.1, <= 3.80.0039 +2 |
| Video Management System | Bosch | unknown | 3.70.0056, 3.70.0058, 3.70.0060, 3.70.0062 +22 |
| Video Recording Manager | Bosch | unknown | < 3.70.0056, < 3.71.0032, < 3.71.0034, < 3.81.0032 +15 |
References
Vendor advisory and patch
- https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0401bt-cve-2019-8951_security_advisory_vrm_open_redirect.pdf
- https://psirt.bosch.com
- https://psirt.bosch.com/Advisory/BOSCH-2019-0401.html
- https://www.boschsecurity.com/xc/en/support/product-security/security-advisories.html
- https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0401bt-cve-2019-8951_security_advisory_vrm_open_redirect.pdf
- https://psirt.bosch.com
- https://psirt.bosch.com/Advisory/BOSCH-2019-0401.html
- https://www.boschsecurity.com/xc/en/support/product-security/security-advisories.html
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.