CVE-2020-6767

A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.

• CWE-22
• CWE-22

• https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.htmlBroken Link, Vendor Advisory
• https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-sa-381489-bt_cve-2020-6767_securityadvisory_bvms_pathtraversal.pdfPatch, Vendor Advisory
• https://psirt.bosch.com/security-advisories/BOSCH-SA-381489-BT.htmlBroken Link, Vendor Advisory

Published

Feb 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6756languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-2…9.8
• CVE-2020-6757contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.…8.8
• CVE-2020-6758A cross-site scripting (XSS) vulnerability in Option/options…6.1
• CVE-2020-6760Schmid ZI 620 V400 VPN 090 routers allow an attacker to exec…9.8
• CVE-2020-6764Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-6765D-Link DSL-GS225 J1 AU_1.0.4 devices allow an admin to execu…7.2
• CVE-2020-6768A path traversal vulnerability in the Bosch Video Management…7.5
• CVE-2020-6769Missing Authentication for Critical Function in the Bosch Vi…9.1
• CVE-2020-6770Deserialization of Untrusted Data in the BVMS Mobile Video S…9.8
• CVE-2020-6771Loading a DLL through an Uncontrolled Search Path Element in…7.8
• CVE-2020-6774Improper Access Control in the Kiosk Mode functionality of B…8.8
• CVE-2020-6776A vulnerability in the web-based management interface of Bos…8.8