CVE-2026-10764

Executive Summary

CVE-2026-10764 is a critical information disclosure vulnerability in Bosch Video Management System (BVMS) versions 4.5 through 12.3, arising from the use of a hard-coded cryptographic key (CWE-321). A man-in-the-middle (MitM) attacker positioned on the network path can exploit this static key to decrypt or forge protected communications, gaining unauthorized access to sensitive data, with potential integrity impact on transmitted information. The vulnerability requires no authentication or user interaction but demands a privileged network position (AC:H), resulting in a CVSS v3.1 base score of 8.7 (High). No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vendor has not released a patch.

Technical Analysis

The root cause of CVE-2026-10764 is categorized as CWE-321: Use of Hard-coded Cryptographic Key. In BVMS 4.5 through 12.3, the product relies on a static, embedded cryptographic key rather than a unique, per-installation secret. Because the key is identical across deployments and cannot be rotated through configuration, any attacker who obtains the key—by extracting it from a client installation, a firmware image, or a captured artifact—can use it to defeat the confidentiality protections that depend on it.

The CVSS vector provides strong constraints on the exploitation model:

• AV:N (Network) — the attack is carried out over a network path; no local access to the target host is required.
• AC:H (High) — success depends on conditions outside the attacker's direct control: the attacker must achieve a man-in-the-middle position on the communication path between BVMS components.
• PR:N (None) — no prior credentials or privileges are required.
• UI:N (None) — no user interaction is required.
• S:C (Changed) — successful exploitation can affect resources beyond the vulnerable component's own security scope, consistent with a shared/static key protecting communications between multiple systems.
• C:H (High) — the stated impact is loss of confidentiality of sensitive data.
• I:H (High) — the vector also assigns high integrity impact, consistent with the ability to not only read but potentially alter protected traffic using the static key.
• A:N (None) — no availability impact is claimed.

The attack surface is the encrypted communication channel(s) that BVMS relies on to protect data in transit. The NVD description states the vulnerability "allows man-in-the-middle attackers to gain unauthorized access to sensitive data." The description does not specify the exact protocol, cipher suite, key derivation, or the interface at which the key is embedded; therefore, no endpoint names, file paths, or function names can be confirmed from the available data and none are asserted here. What can be stated with confidence from the classification and vector is the flaw class: a static key shared across installations breaks the confidentiality (and integrity) guarantees of any mechanism that depends solely on secrecy of that key, because compromise of one instance compromises all instances.

Two practical consequences follow from CWE-321 in this context:

1. Mass compromise potential — because the key is not unique per deployment, a single extracted key is reusable against every affected BVMS installation (4.5 – 12.3), collapsing what would be a per-target effort into a one-time extraction problem.
2. No forward secrecy — a static key cannot be rotated easily, so previously captured ciphertext may remain decryptable if the key is later obtained (retroactive decryption of recorded traffic).

Specific technical details beyond the above—such as the location of the hard-coded key, the exact cryptographic algorithm, and the protected interface—are not available in the supplied intelligence and should not be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-321 hard-coded key) and the CVSS vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H).

1. Reconnaissance / target identification — An adversary identifies Bosch BVMS deployments (versions 4.5–12.3) on a target network or as reachable management/communications endpoints. This can be done via network scanning and fingerprinting of BVMS-related services, or via internet-wide search engines using product/title fingerprints such as those in the Shodan dorks above. The attacker also maps the communication topology to determine where a man-in-the-middle position could be established (e.g., between BVMS clients, servers, and managed devices).

2. Triggering the flaw class — The attacker obtains the hard-coded cryptographic key. Because CWE-321 keys are embedded constant values, acquisition may come from a legitimate/leaked client or server installation, a firmware artifact, or any captured material in which the constant is present. No authentication is needed (PR:N) and no victim interaction is required (UI:N). This step is the principal obstacle and is reflected in the AC:H rating—the attacker must both obtain the key and achieve a network position to use it.

3. Execution / MitM interception — With the static key in hand, the attacker establishes a man-in-the-middle position on the communication path (e.g., via ARP spoofing, rogue access point, or control of an intermediate network device) and intercepts encrypted traffic protected by the static key. The attacker uses the key to decrypt the captured session data (C:H). Where the same key also authenticates or integrity-protects messages, the attacker can potentially forge or modify traffic (I:H), though the NVD description emphasizes unauthorized access to sensitive data rather than demonstrated message-forging—this integrity capability is inferred from the vector, not from an observed exploit.

4. Post-exploitation impact — Decrypted traffic yields sensitive data (e.g., video-related metadata, credentials, or operational data transiting BVMS communication channels—the exact content is not specified in the available data). Because the key is shared across installations, the attacker may reuse the same key against other affected BVMS systems. Scope change (S:C) indicates impact can extend to components beyond the initially vulnerable one.

Caveat: The sections above describe the attack at the vulnerability-class level. No function names, class names, endpoints, file paths, or parameters are invented, as none are confirmed by the provided description.

Impact Assessment

• Confidentiality (C:H): The confirmed and primary impact—sensitive data transmitted over key-protected BVMS channels can be read by a man-in-the-middle attacker.
• Integrity (I:H): The CVSS vector assigns high integrity impact, indicating protected data/communications may be altered under the static key.
• Availability (A:N): No availability impact is claimed.
• Scope (S:C): Impact can extend beyond the vulnerable component, affecting other systems that trust the shared key.
• Base Score: 8.7 (High), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.

Business impact and blast radius: BVMS is a physical-security / video management platform; compromise of its protected data may expose surveillance-related information, operational metadata, and potentially credentials, with downstream privacy, compliance, and physical-security consequences. Because the key is hard-coded and shared, blast radius is large: every affected deployment (4.5–12.3) using the static key is potentially impacted by a single key compromise. The AC:H requirement (privileged network position) limits opportunistic mass exploitation but is well within reach of a determined insider or an attacker who controls network infrastructure. EPSS has not yet been scored by FIRST.org, and the CVE is not listed in CISA KEV; no exploitation in the wild has been confirmed.

Detection Guidance

Detection focuses on anomalous man-in-the-middle activity and on enforcement of cryptographic integrity where possible. Because the vulnerability is a static-key weakness, host-based detection is limited; network-integrity and traffic-anomaly monitoring are the primary controls.

Sigma Rule

title: Potential Man-in-the-Middle Activity Against BVMS Communications
id: 7b2f9c1e-bvms-mitm-0001
status: experimental
description: Detects indicators of ARP/route anomalies consistent with a man-in-the-middle position targeting Bosch BVMS (CVE-2026-10764).
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_arp:
    EventID: 4688
    CommandLine|contains:
      - 'arpspoof'
      - 'ettercap'
      - 'bettercap'
      - 'mitm'
  selection_dup_ip:
    EventID: 4001
    NewIPAddress: '*'
  condition: selection_arp or selection_dup_ip
level: high
tags:
  - attack.t1040
  - attack.t1557
  - cve.2026.10764

YARA Rule

rule CVE_2026_10764_BVMS_Hardcoded_Key_Artifact
{
    meta:
        description = "Detects artifacts associated with hard-coded cryptographic key material in BVMS-related files (CVE-2026-10764). Tune key material patterns to your environment."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-10764"
        date = "2026-01-01"
        cve = "CVE-2026-10764"
    strings:
        $s1 = "BVMS" ascii wide
        $s2 = "Video Management System" ascii wide
        $k1 = "BEGIN PRIVATE KEY" ascii
        $k2 = "BEGIN RSA PRIVATE KEY" ascii
        $k3 = "hardcoded" ascii
        $k4 = "staticKey" ascii
        $k5 = "aes_key" ascii
    condition:
        (uint32be(0) == 0x4D5A) or ($s1 and any of ($k*)) or (any of ($s*) and any of ($k1, $k2))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-10764 Possible BVMS Static-Key MITM - Repeated TLS/Re-Key Anomaly"; flow:established,to_server; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-10764; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-10764; sid:2026107640; rev:1;)

Elastic Detection

network where event.action == "connection" and
  (process.name in ("arpspoof", "ettercap", "bettercap") or
   network.direction == "unknown" and network.transport == "tcp" and
   network.protocol in ("tls", "https") and destination.port in (443, 8443, 5001))

Splunk SPL Query

index=network OR index=firewall
| search ("BVMS" OR "Bosch Video Management" OR dest_port IN (443,8443,5001))
| stats count dc(src_ip) as src_count by dest_ip, dest_port
| where dest_port IN (443,8443,5001) OR src_count > 3
| eval cve="CVE-2026-10764", severity="high", mitre="T1040"
| table _time, src_ip, src_count, dest_ip, dest_port, cve, severity, mitre

Wazuh OSSEC Rule

<group name="bosch,bvms,cve-2026-10764,">
  <rule id="202610764" level="12">
    <if_sid>1002</if_sid>
    <description>CVE-2026-10764: Possible man-in-the-middle activity targeting BVMS communications</description>
    <match>BVMS|Video Management System|mitm|arp spoof</match>
    <mitre>
      <id>T1040</id>
      <id>T1557</id>
    </mitre>
    <group>cve_2026_10764,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the available intelligence.

1. Immediate mitigations

   • Segment BVMS networks from untrusted and general-purpose networks; isolate management and video traffic into dedicated VLANs with strict inter-VLAN ACLs to reduce the feasibility of a man-in-the-middle position (directly addresses the AC:H requirement).
   • Enable dynamic ARP inspection, DHCP snooping, and port security; monitor for duplicate IPs and ARP anomalies that indicate MitM positioning.
   • Do not expose BVMS management/communications interfaces to the internet; restrict access to trusted hosts via firewalls.
   • Where possible, place all BVMS communication over a monitored, integrity-protected transport (e.g., an IPsec/mTLS overlay with per-peer credentials) that does not rely on the product's static key.

2. Patch/upgrade steps

   • No patch is available. Monitor the Bosch product security advisory channel for BVMS security bulletins and upgrade to the first release that replaces the hard-coded key with per-installation, rotatable credentials.
   • Inventory all BVMS deployments and confirm exact versions (4.5 through 12.3 are reported affected). Treat all in-range versions as vulnerable until a fixed release is confirmed.

3. Long-term hardening

   • Require unique, per-installation cryptographic material and support key rotation in vendor procurement and security requirements.
   • Deploy certificate-pinning or an independent encrypted tunnel for BVMS traffic so that compromise of one embedded key does not collapse confidentiality across the estate.
   • Maintain continuous network monitoring for MitM patterns and monitor for any future public PoC or exploitation reporting for CVE-2026-10764.

References

• NVD — CVE-2026-10764: https://nvd.nist.gov/vuln/detail/CVE-2026-10764
• CWE-321: Use of Hard-coded Cryptographic Key — https://cwe.mitre.org/data/definitions/321.html
• FIRST EPSS — (CVE-2026-10764 not yet scored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — (CVE-2026-10764 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Bosch Building Technologies — Product Security advisories (monitor for BVMS updates): https://www.boschsecurity.com/

No public PoC, exploit code, or Nuclei template is available; no exploitation in the wild or threat-actor campaign has been attributed to this CVE. The vulnerability is not listed in CISA KEV.