Lucene search

[email protected]CVE-2023-45220

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-45220

2023-10-2518:17:33

CWE-306

[email protected]

web.nvd.nist.gov

android

client application

http

https

security

sensitive information

mqtt

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user.

Affected configurations

NVD

Node

boschrexrothctrlx_hmi_web_panel_wr2107_firmware

AND

boschrexrothctrlx_hmi_web_panel_wr2107Match-

Node

boschrexrothctrlx_hmi_web_panel_wr2110_firmware

AND

boschrexrothctrlx_hmi_web_panel_wr2110Match-

Node

boschrexrothctrlx_hmi_web_panel_wr2115_firmware

AND

boschrexrothctrlx_hmi_web_panel_wr2115Match-

CPENameOperatorVersion
boschrexroth:ctrlx_hmi_web_panel_wr2107_firmwareboschrexroth ctrlx hmi web panel wr2107 firmwareeq*

CPE	Name	Operator	Version
boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware	boschrexroth ctrlx hmi web panel wr2107 firmware	eq	*

CNA Affected

[
  {
    "vendor": "Rexroth",
    "product": "ctrlX HMI Web Panel - WR21 (WR2107)",
    "versions": [
      {
        "version": "all",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Rexroth",
    "product": "ctrlX HMI Web Panel - WR21 (WR2110)",
    "versions": [
      {
        "version": "all",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Rexroth",
    "product": "ctrlX HMI Web Panel - WR21 (WR2115)",
    "versions": [
      {
        "version": "all",
        "status": "affected"
      }
    ]
  }
]

References

psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

Related for CVE-2023-45220

prion1 cvelist1 nvd1