Vulnerability · Published Oct 25, 2023 · Assigned by bosch
CVE-2023-45844
High 7.3
In plain English
A high-severity improper access control in ctrlX HMI Web Panel - WR21 (WR2107) from Rexroth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.0)7.3High
Exploit odds (30 days)0.4%top 67.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2107) | all |
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2110) | all |
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2115) | all |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html vendor-advisory