CameraRisk

CVE-2023-35867

Bosch

Published
18 December 2023
Last modified
17 June 2026
CVSS
5.9 v3.1
Severity
medium
EPSS
0.6% (44th pct)
CISA KEV
Not listed
NVD status
Modified
Weaknesses
CWE-703

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.

Exploitation

Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 0.6% probability of exploitation activity in the next 30 days.

Affected products

ProductVendorTypeVersions named
Onvif Camera Event Driver Tool Bosch IP camera <= 2.0.0.8
Bosch Video Management System Bosch unknown 10.1, 11.0, < 10.0.2, <= 10.1.1 +6
Building Integration System Video Engine Bosch unknown <= 5.0.1
Divar IP 7000 R2 Bosch unknown <= 11.1.1, <= 12.0, >= 7.5
Divar IP All-in-one 4000 Bosch unknown <= 12.0
Divar IP All-in-one 5000 Bosch unknown <= 12.0
Divar IP All-in-one 6000 Bosch unknown <= 12.0
Divar IP All-in-one 7000 Bosch unknown <= 12.0
Divar IP All-in-one 7000 R3 Bosch unknown <= 12.0
Video Management System Viewer Bosch unknown < 10.0.2, < 10.1.1, < 9.0, <= 10.0.0.1225 +10
Video Security Client Bosch Video management software <= 3.3.5

References

Vendor advisory and patch

CVE-2023-35867 at NVD

Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.