Vulnerability Snapshot
CVE-2018-19036 is rated CRITICAL — exploitation is trivial or already observed in the wild and impact is severe. Patch immediately, not on the next maintenance window.
Affected technology: common_product_platform_4_firmware, autodome_ip_4000_hd, autodome_ip_5000_hd, autodome_ip_5000_ir, autodome_ip_7000, plus 5 other product variants.
Executive Summary
An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface.
Why It Matters
CVE-2018-19036 is rated CRITICAL severity, requiring immediate attention from security teams.
CVSS Base Score: 9.8/10
Affected Technologies
Vendors: bosch
Products: common_product_platform_4_firmware, autodome_ip_4000_hd, autodome_ip_5000_hd, autodome_ip_5000_ir, autodome_ip_7000, dinion_hd_1080p, dinion_hd_1080p_hdr, dinion_hd_720p, dinion_imager_9000_hd, dinion_ip_4000_hd, dinion_ip_5000_hd, dinion_ip_5000_mp, dinion_ip_bullet_4000, dinion_ip_bullet_5000, dinion_ip_starlight_7000_hd, extegra_ip_dynamic_9000, extegra_ip_starlight_9000, flexidome_corner_9000_mp, flexidome_hd_1080p, flexidome_hd_1080p_hdr, flexidome_hd_720p, flexidome_ip_indoor_4000_hd, flexidome_ip_indoor_4000_ir, flexidome_ip_indoor_5000_hd, flexidome_ip_indoor_5000_mp, flexidome_ip_micro_2000_hd, flexidome_ip_micro_2000_ip, flexidome_ip_micro_5000_hd, flexidome_ip_micro_5000_mp, flexidome_ip_outdoor_4000_hd, flexidome_ip_outdoor_4000_ir, flexidome_ip_outdoor_5000_hd, flexidome_ip_outdoor_5000_mp, flexidome_ip_panormic_5000, ip_2000, ip_2000_hd, ip_bullet_4000_hd, ip_bullet_5000_hd, mic_ip_dynamic_7000, mic_ip_starlight_7000, tinyon_ip_2000, vandal-proof_flexidome_hd_1080p, vandal-proof_flexidome_hd_1080p_hdr, vandal-proof_flexidome_hd_720p, common_product_platform_6_firmware, aviotec_ip_starlight_8000, dinion_ip_starlight_8000_12mp, dinion_ip_ultra_8000_12mp, flexidome_ip_panoramic_6000_12mp_180, flexidome_ip_panoramic_6000_12mp_180_iva, flexidome_ip_panoramic_6000_12mp_360, flexidome_ip_panoramic_6000_12mp_360_iva, flexidome_ip_panoramic_7000_12mp_180, flexidome_ip_panoramic_7000_12mp_180_iva, flexidome_ip_panoramic_7000_12mp_360, flexidome_ip_panoramic_7000_12mp_360_iva, common_product_platform_7_firmware, dinion_ip_starlight_6000, dinion_ip_starlight_7000, dinion_ip_thermal_8000, flexidome_ip_starlight_6000, flexidome_ip_starlight_7000, common_product_platform_7.3_firmware, autodome_ip_4000i, autodome_ip_5000i, autodome_ip_starlight_5000i, autodome_ip_starlight_7000i, dinion_ip_bullet_4000i, dinion_ip_bullet_5000i, dinion_ip_bullet_6000i, flexidome_ip_4000i, flexidome_ip_5000i, mic_ip_fusion_9000i, mic_ip_starlight_7000i
🛡️What Defenders Should Check
Use Vulnios to continuously monitor your exposure to CVE-2018-19036 and similar vulnerabilities.
References & Sources
How Vulnios Detects This
Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.
AI Security Advisor
Powered by Gemini
Get AI-powered security recommendations tailored to this specific threat — including risk assessment, detection guidance, MITRE ATT&CK mapping, and actionable remediation steps.
Affected Products
Sources
Related Threat Alerts
- Critical Vulnerability: CVE-2020-6779 — bosch — fsm-2500_firmware, fsm-2500
- Critical Vulnerability: CVE-2020-6774 — bosch — recording_station_firmware, recording_station
- Critical Vulnerability: CVE-2020-6769 — bosch — video_streaming_gateway, divar_ip_2000_firmware
- Critical Vulnerability: CVE-2020-6770 — bosch — bosch_video_management_system_mobile_video_service, divar_ip_3000_firmware
- Critical Vulnerability: CVE-2019-11898 — bosch — access
- Critical Vulnerability: CVE-2019-6957 — bosch — access_professional_edition, bosch_video_client
Frequently Asked Questions
What is CVE-2018-19036?
CVE-2018-19036 is a critical-severity vulnerability tracked under the Common Vulnerabilities and Exposures program. An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could potentially succeed in the unauthorized execution of code on the device via the netw
Am I affected?
Check whether your environment runs common_product_platform_4_firmware, autodome_ip_4000_hd, autodome_ip_5000_hd, autodome_ip_5000_ir, autodome_ip_7000. If you operate any of those, treat yourself as in scope until you have evidence otherwise. A Vulnios scan will identify the exact assets carrying the affected version.
How urgent is the response?
Critical: do not wait for your normal patch cycle. Verify exposure today, apply the vendor patch immediately, and add detection rules for any post-exploit indicators.
How do I remediate?
Apply the vendor patch listed in the upstream advisory linked under Sources. If the patch is not yet available, follow the vendor-supplied workaround (often a config flag or feature disable) and add detections for the published exploit pattern in your SIEM. Re-scan after the patch lands to confirm the finding clears.
Where can I track exploitation activity?
Watch CISA's Known Exploited Vulnerabilities catalog for CVE-2018-19036. Cross-reference with public exploit databases and your own SIEM/IDS for indicator-of-compromise patterns. Vulnios tracks KEV status automatically and surfaces it on the asset findings view.
How does Vulnios help with this?
Vulnios continuously cross-references your asset inventory against the live CVE feed (NVD, vendor advisories, CISA KEV, and curated OSINT). When a new CVE matches your environment, you get a prioritized finding with the severity, KEV status, exploit-prediction (EPSS), and a direct path to the vendor patch. You can start a free scan from the homepage.
Protect Your Organization
Monitor CVEs, scan for vulnerabilities, and get real-time threat alerts — all in one platform.
Weekly threat digest
KEV-listed exploits and vendor advisories, every Monday.
One email a week. Unsubscribe any time.
Get instant alerts on Telegram
Join our public channel for real-time critical CVE alerts.
Follow @vulnios