{"id":"CVE-2019-11601","aliases":["EUVD-2019-3271","GHSA-hjqr-g8j9-j3vw"],"status":"published","title":"Path traversal in the backup \u0026 restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software","description":"A directory traversal vulnerability in remote access to backup \u0026 restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.","severity":{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02688,"percentile":0.85964,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2019-08-21T19:09:01Z","modified":"2026-06-17T02:13:14Z","products":[{"vendor":"bosch","product":"iot_gateway_software"},{"vendor":"bosch","product":"prosyst_mbs_sdk"}],"references":[{"url":"https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11601"},{"url":"https://github.com/advisories/GHSA-hjqr-g8j9-j3vw"}],"sources":{"cve":[{"id":"CVE-2019-11601","title":"Path traversal in the backup \u0026 restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software","description":"A directory traversal vulnerability in remote access to backup \u0026 restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.","status":"published","published":"2019-08-21T19:09:01.029Z","modified":"2024-09-16T17:59:22.845Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-3271","description":"A directory traversal vulnerability in remote access to backup \u0026 restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.","status":"published","published":"2019-08-21T19:09:01Z","modified":"2024-09-16T17:59:22Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:36.806318Z"}],"ghsa":[{"id":"GHSA-hjqr-g8j9-j3vw","title":"A directory traversal vulnerability in remote access to backup \u0026 restore in earlier versions than...","description":"A directory traversal vulnerability in remote access to backup \u0026 restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.","status":"published","published":"2022-05-24T16:54:21Z","modified":"2023-02-02T21:34:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:52:47.993176Z"}],"nvd":[{"id":"CVE-2019-11601","description":"A directory traversal vulnerability in remote access to backup \u0026 restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.","status":"published","published":"2019-08-21T20:15:12.447Z","modified":"2026-06-17T02:13:14.943Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:23.725587Z"}]}}