Vulnerability · Published Oct 4, 2021 · Assigned by bosch
CVE-2021-23855Information disclosure
High 8.6
In plain English
A high-severity information exposure in IndraMotion MLC IndraMotion XLC from Rexroth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.6%top 51.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rexroth | IndraMotion MLC IndraMotion XLC | All |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://psirt.bosch.com/security-advisories/bosch-sa-741752.html x_refsource_CONFIRM