CVE-2019-8952
Bosch
- Published
- 13 May 2019
- Last modified
- 17 June 2026
- CVSS
- 6.5 v3.0
- Severity
- medium
- EPSS
- 1.4% (71th pct)
- CISA KEV
- Not listed
- NVD status
- Modified
- Weaknesses
- CWE-22
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032).
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. The catalogue records confirmed public exploitation. Absence from it does not establish that exploitation has not occurred. EPSS models a 1.4% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| Divar IP 2000 | Bosch | unknown | < 3.62.0019, <= 3.62.0019 |
| Divar IP 5000 | Bosch | unknown | < 3.80.0033, < 3.80.0039, <= 11.1.1, <= 3.80.0039 +2 |
| Video Management System | Bosch | unknown | 3.70.0056, 3.70.0058, 3.70.0060, 3.70.0062 +22 |
| Video Recording Manager | Bosch | unknown | < 3.70.0056, < 3.71.0032, < 3.71.0034, < 3.81.0032 +15 |
References
Vendor advisory and patch
- https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0402bt-cve-2019-8952_security_advisory_vrm_path_traversal.pdf
- https://psirt.bosch.com
- https://psirt.bosch.com/Advisory/BOSCH-2019-0402.html
- https://www.boschsecurity.com/xc/en/support/product-security/security-advisories.html
- https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0402bt-cve-2019-8952_security_advisory_vrm_path_traversal.pdf
- https://psirt.bosch.com
- https://psirt.bosch.com/Advisory/BOSCH-2019-0402.html
- https://www.boschsecurity.com/xc/en/support/product-security/security-advisories.html
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.