Description

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-30T10:17:16.960Z",
  "pubdate": "2026-09-30T10:17:16.960Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw present in Bosch Video Management System (BVMS), versions 4.5 through 12.3. The security defect allows an unauthenticated, remote attacker positioned in a man-in-the-middle (MitM) capacity to intercept and access sensitive data transmitted between system components. By positioning themselves between communicating nodes, an attacker can bypass traditional security controls to exfiltrate confidential information. The risk implication is significant, as the exposure of sensitive data may lead to unauthorized system monitoring, the compromise of credentials, or the leakage of proprietary operational metadata. Successful exploitation requires the attacker to actively influence network traffic routing or intercept communications on a segment shared with BVMS infrastructure. The vulnerability highlights a failure in securing data-in-transit, potentially undermining the confidentiality and integrity of the entire video management ecosystem.",
  "technicalDetails": "The vulnerability originates from insufficient security controls during data transmission within the BVMS architecture. BVMS, spanning versions 4.5 to 12.3, fails to properly secure inter-component communication, rendering the system susceptible to interception when traffic is routed over insecure or compromised network segments. The root cause is identified as a lack of robust encryption or proper authentication mechanisms for sensitive data flows, which allows an attacker to perform Man-in-the-Middle (MitM) interception.\nThe exploitation process typically follows a structured attack flow. First, an attacker must gain a position in the network topology that allows traffic interception—such as an ARP spoofing attack on a local area network (LAN) or compromise of a network switch/gateway. Once the attacker is successfully situated between the client and the BVMS server or between distributed components, they initiate traffic sniffing or packet injection.\nBecause the communication protocol lacks sufficient cryptographic enforcement, the attacker can passively monitor or actively manipulate the data packets traversing the connection. The exposed information is sensitive, and the interception allows the attacker to reconstruct raw data payloads, which may contain authentication tokens, configuration details, or other sensitive operational metadata. In some scenarios, the lack of Mutual TLS (mTLS) or equivalent identity verification allows the attacker to impersonate legitimate system entities, further escalating the impact of the disclosure.\nThe attack is characterized by its reliance on network positioning rather than complex software exploitation or memory corruption techniques. The vulnerability exists because of how the BVMS components handle communication sessions during the specified version range. No authentication or elevated privileges are required for the attacker to initiate the intercept; the vulnerability is inherent to the insecure transport state of the network communication. Once the data is disclosed, the post-exploitation impact includes the potential for session hijacking, credential harvesting, and long-term surveillance of security operations, which could be leveraged to facilitate further unauthorized access or disruption of the video management system."
}