Vulnerability · Published Oct 25, 2023 · Assigned by bosch
CVE-2023-45851
High 8.8
In plain English
A high-severity missing authentication in ctrlX HMI Web Panel - WR21 (WR2107) from Bosch Rexroth AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch Rexroth AG | ctrlX HMI Web Panel - WR21 (WR2107) | all |
| Bosch Rexroth AG | ctrlX HMI Web Panel - WR21 (WR2110) | all |
| Bosch Rexroth AG | ctrlX HMI Web Panel - WR21 (WR2115) | all |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html vendor-advisory