Lucene search

[email protected]CVE-2023-41372

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-41372

2023-10-2518:17:30

CWE-798

[email protected]

web.nvd.nist.gov

cve-2023-41372

vulnerability

android

client application

broadcast intent

rsa

security

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcoded RSA key pair

Affected configurations

NVD

Node

boschrexrothctrlx_hmi_web_panel_wr2107Match-

AND

boschrexrothctrlx_hmi_web_panel_wr2107_firmware

Node

boschrexrothctrlx_hmi_web_panel_wr2110Match-

AND

boschrexrothctrlx_hmi_web_panel_wr2110_firmware

Node

boschrexrothctrlx_hmi_web_panel_wr2115Match-

AND

boschrexrothctrlx_hmi_web_panel_wr2115_firmware

CPENameOperatorVersion
boschrexroth:ctrlx_hmi_web_panel_wr2107_firmwareboschrexroth ctrlx hmi web panel wr2107 firmwareeq*

CPE	Name	Operator	Version
boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware	boschrexroth ctrlx hmi web panel wr2107 firmware	eq	*

CNA Affected

[
  {
    "vendor": "Rexroth",
    "product": "ctrlX HMI Web Panel - WR21 (WR2107)",
    "versions": [
      {
        "version": "all",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Rexroth",
    "product": "ctrlX HMI Web Panel - WR21 (WR2110)",
    "versions": [
      {
        "version": "all",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Rexroth",
    "product": "ctrlX HMI Web Panel - WR21 (WR2115)",
    "versions": [
      {
        "version": "all",
        "status": "affected"
      }
    ]
  }
]

References

psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVE-2023-41372

cvelist1 prion1 nvd1