CVE-2019-11684
📋 TL;DR
This vulnerability allows unauthenticated attackers to access a limited subset of certificates stored in the Windows operating system through improper access control in Bosch Video Recording Manager's RCP+ server. It affects Bosch VRM v3.70.x, v3.71 < v3.71.0034, v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; and all BVMS versions using VRM.
💻 Affected Systems
- Bosch Video Recording Manager (VRM)
- DIVAR IP 5000
- BVMS (Bosch Video Management System)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal certificates to impersonate legitimate systems, establish persistence, or perform man-in-the-middle attacks against the video surveillance infrastructure.
Likely Case
Unauthenticated access to certificate data that could be used for reconnaissance or as part of a broader attack chain against the surveillance system.
If Mitigated
Limited certificate exposure with minimal impact if proper network segmentation and access controls are implemented.
🎯 Exploit Status
The vulnerability allows unauthenticated access, suggesting relatively straightforward exploitation once the attack vector is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: VRM v3.71.0034, v3.81.0050; DIVAR IP 5000 3.80.0039
Vendor Advisory: https://psirt.bosch.com/security-advisories/bosch-sa-804652.html
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Bosch support portal. 2. Backup current configuration. 3. Apply the patch following Bosch's installation instructions. 4. Restart the system. 5. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Network Segmentation
allIsolate VRM/RCP+ servers from untrusted networks and restrict access to authorized IPs only.
Firewall Rules
allBlock external access to RCP+ server ports (typically 443/TCP for HTTPS) from untrusted networks.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from untrusted networks
- Deploy network monitoring and intrusion detection for RCP+ server traffic anomalies
🔍 How to Verify
Check if Vulnerable:
Check VRM version in the web interface or via Windows registry at HKEY_LOCAL_MACHINE\SOFTWARE\Bosch\VRM\VersionCheck Version:
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Bosch\VRM" /v VersionVerify Fix Applied:
Verify version is at least VRM v3.71.0034, v3.81.0050, or DIVAR IP 5000 3.80.0039📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to RCP+ server endpoints
- Certificate access or export events from VRM logs
Network Indicators:
- Unusual traffic patterns to RCP+ server ports from unauthorized sources
- Certificate-related requests to VRM systems
SIEM Query:
source="VRM" AND (event="unauthorized_access" OR event="certificate_access")