# cve.now: Bosch

The newest entries naming Bosch as an affected vendor (up to 200), of 73 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-56428](https://cve.now/CVE-2026-56428.md): The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default con (CVSS 8.1)
- [CVE-2024-58330](https://cve.now/CVE-2024-58330.md): A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytic (CVSS 7.5)
- [CVE-2024-58023](https://cve.now/CVE-2024-58023.md): Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. (CVSS 8.4)
- [CVE-2024-33618](https://cve.now/CVE-2024-33618.md): Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk sp (CVSS 7.5)
- [CVE-2025-32063](https://cve.now/CVE-2025-32063.md): Enabling SSH server on Infotainment ECU (CVSS 6.8)
- [CVE-2025-32062](https://cve.now/CVE-2025-32062.md): Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU (CVSS 8.8)
- [CVE-2025-32061](https://cve.now/CVE-2025-32061.md): Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU (CVSS 8.8)
- [CVE-2025-32060](https://cve.now/CVE-2025-32060.md): Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU (CVSS 6.7)
- [CVE-2025-32059](https://cve.now/CVE-2025-32059.md): Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU (CVSS 8.8)
- [CVE-2025-32058](https://cve.now/CVE-2025-32058.md): Stack Overflow in processing requests over INC interface on RH850 side of Infotainment ECU (CVSS 9.3)
- [CVE-2025-32057](https://cve.now/CVE-2025-32057.md): Misconfigured SSL/TLS communication of Redbend service for Infotainment ECU (CVSS 6.5)
- [CVE-2025-32056](https://cve.now/CVE-2025-32056.md): Anti-Theft Bypass for Infotainment ECU (CVSS 4.0)
- [CVE-2023-32228](https://cve.now/CVE-2023-32228.md): A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last (CVSS 4.6)
- [CVE-2024-25002](https://cve.now/CVE-2024-25002.md): Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. (CVSS 8.8)
- [CVE-2023-49722](https://cve.now/CVE-2023-49722.md): Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi netw (CVSS 8.3)
- [CVE-2022-41677](https://cve.now/CVE-2022-41677.md): An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve informati (CVSS 5.3)
- [CVE-2023-35867](https://cve.now/CVE-2023-35867.md): An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to (CVSS 5.9)
- [CVE-2023-32230](https://cve.now/CVE-2023-32230.md): An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to caus (CVSS 7.5)
- [CVE-2023-39509](https://cve.now/CVE-2023-39509.md): A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary c (CVSS 7.2)
- [CVE-2023-29241](https://cve.now/CVE-2023-29241.md): Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows (CVSS 8.1)
- [CVE-2023-28175](https://cve.now/CVE-2023-28175.md): Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the (CVSS 7.1)
- [CVE-2023-32229](https://cve.now/CVE-2023-32229.md): Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanen (CVSS 4.9)
- [CVE-2022-47648](https://cve.now/CVE-2022-47648.md): An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorizat (CVSS 7.6)
- [CVE-2022-40184](https://cve.now/CVE-2022-40184.md): Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000 (CVSS 5.1)
- [CVE-2022-40183](https://cve.now/CVE-2022-40183.md): Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000 (CVSS 5.8)
- [CVE-2022-32540](https://cve.now/CVE-2022-32540.md): Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 (CVSS 7.4)
- [CVE-2022-36302](https://cve.now/CVE-2022-36302.md): File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access dif (CVSS 8.8)
- [CVE-2022-36301](https://cve.now/CVE-2022-36301.md): BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device passw (CVSS 9.8)
- [CVE-2022-32536](https://cve.now/CVE-2022-32536.md): Privilege Escalation (CVSS 8.8)
- [CVE-2022-32534](https://cve.now/CVE-2022-32534.md): OS Command Injection (CVSS 8.8)
- [CVE-2022-32535](https://cve.now/CVE-2022-32535.md): Web server runs as root (CVSS 4.8)
- [CVE-2021-23851](https://cve.now/CVE-2021-23851.md): Buffer Overflow vulnerability in the recovery image web-based interface (CVSS 6.8)
- [CVE-2021-23850](https://cve.now/CVE-2021-23850.md): Buffer Overflow vulnerability in the recovery image telnet server (CVSS 6.8)
- [CVE-2021-23843](https://cve.now/CVE-2021-23843.md): Lack of authentication mechanisms on the device (CVSS 8.8)
- [CVE-2021-23842](https://cve.now/CVE-2021-23842.md): Use of Hard-coded Cryptographic Key (CVSS 5.7)
- [CVE-2021-23862](https://cve.now/CVE-2021-23862.md): Authenticated Remote Code Execution (CVSS 7.2)
- [CVE-2021-23861](https://cve.now/CVE-2021-23861.md): Possible Access to Debug Functions in Bosch VRM / BVMS (CVSS 6.5)
- [CVE-2021-23860](https://cve.now/CVE-2021-23860.md): Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS (CVSS 5.0)
- [CVE-2021-23859](https://cve.now/CVE-2021-23859.md): Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products (CVSS 9.1)
- [CVE-2021-23849](https://cve.now/CVE-2021-23849.md): Cross Site Request Forgery (CSRF) vulnerability in web based management interface (CVSS 7.5)
- [CVE-2021-23846](https://cve.now/CVE-2021-23846.md): B426 Credential Disclosure (CVSS 8.8)
- [CVE-2021-23845](https://cve.now/CVE-2021-23845.md): B426 Web Configuration Authentication Bypass (CVSS 8.0)
- [CVE-2021-23854](https://cve.now/CVE-2021-23854.md): Reflected XSS in page parameter (CVSS 8.3)
- [CVE-2021-23847](https://cve.now/CVE-2021-23847.md): Unauthenticated Information Extraction Vulnerability (CVSS 9.8)
- [CVE-2021-23853](https://cve.now/CVE-2021-23853.md): Improper Input Validation of HTTP Headers (CVSS 8.3)
- [CVE-2021-23848](https://cve.now/CVE-2021-23848.md): Reflected XSS in URL handler (CVSS 8.3)
- [CVE-2021-23852](https://cve.now/CVE-2021-23852.md): Denial of Service (DoS) due to invalid web parameter (CVSS 4.9)
- [CVE-2020-6790](https://cve.now/CVE-2020-6790.md): Uncontrolled Search Path Element in Bosch Video Streaming Gateway Installer (CVSS 7.8)
- [CVE-2020-6789](https://cve.now/CVE-2020-6789.md): Uncontrolled Search Path Element in Bosch Monitor Wall Installer (CVSS 7.8)
- [CVE-2020-6788](https://cve.now/CVE-2020-6788.md): Uncontrolled Search Path Element in Bosch Configuration Manager Installer (CVSS 7.8)
- [CVE-2020-6787](https://cve.now/CVE-2020-6787.md): Uncontrolled Search Path Element in Bosch Video Client installer (CVSS 7.8)
- [CVE-2020-6786](https://cve.now/CVE-2020-6786.md): Uncontrolled Search Path Element in Bosch Video Recording Manager Installer (CVSS 7.8)
- [CVE-2020-6785](https://cve.now/CVE-2020-6785.md): Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer (CVSS 7.8)
- [CVE-2020-6771](https://cve.now/CVE-2020-6771.md): Uncontrolled Search Path Element in Bosch IP Helper (CVSS 7.8)
- [CVE-2020-6780](https://cve.now/CVE-2020-6780.md): Password Hash With Insufficient Computational Effort in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server (CVSS 4.4)
- [CVE-2020-6779](https://cve.now/CVE-2020-6779.md): Hard-coded Credentials in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server (CVSS 10.0)
- [CVE-2020-6777](https://cve.now/CVE-2020-6777.md): Stored XSS in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface (CVSS 4.8)
- [CVE-2020-6776](https://cve.now/CVE-2020-6776.md): CSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface (CVSS 8.8)
- [CVE-2020-6781](https://cve.now/CVE-2020-6781.md): Improper Certificate Validation in Bosch Smart Home System App for iOS (CVSS 6.8)
- [CVE-2020-6774](https://cve.now/CVE-2020-6774.md): Kiosk Mode Breakout in Bosch Recording Station (CVSS 9.3)
- [CVE-2020-6770](https://cve.now/CVE-2020-6770.md): Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service (CVSS 10.0)
- [CVE-2020-6768](https://cve.now/CVE-2020-6768.md): Path Traversal in Bosch Video Management System (BVMS) (CVSS 8.6)
- [CVE-2020-6769](https://cve.now/CVE-2020-6769.md): Missing Authentication for Critical Function in Bosch Video Streaming Gateway (CVSS 10.0)
- [CVE-2020-6767](https://cve.now/CVE-2020-6767.md): Path Traversal in Bosch Video Management System (BVMS) (CVSS 7.7)
- [CVE-2019-11899](https://cve.now/CVE-2019-11899.md): An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. (CVSS 8.8)
- [CVE-2019-11898](https://cve.now/CVE-2019-11898.md): Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. (CVSS 9.9)
- [CVE-2019-11897](https://cve.now/CVE-2019-11897.md): Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software (CVSS 8.6)
- [CVE-2019-11896](https://cve.now/CVE-2019-11896.md): Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) (CVSS 5.5)
- [CVE-2019-11895](https://cve.now/CVE-2019-11895.md): Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) (CVSS 5.3)
- [CVE-2019-11894](https://cve.now/CVE-2019-11894.md): Improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC) (CVSS 5.7)
- [CVE-2019-11893](https://cve.now/CVE-2019-11893.md): Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC) (CVSS 5.5)
- [CVE-2019-11892](https://cve.now/CVE-2019-11892.md): Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) (CVSS 7.5)
- [CVE-2019-11891](https://cve.now/CVE-2019-11891.md): Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC) (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bosch
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.