Lucene search

[email protected]NVD:CVE-2023-41372

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-41372

2023-10-2518:17:30

CWE-798

[email protected]

web.nvd.nist.gov

vulnerability

unprivileged

app

modify

android

client

settings

rsa

key

pair

attack

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.2%

JSON

The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcoded RSA key pair

Affected configurations

NVD

Node

boschrexrothctrlx_hmi_web_panel_wr2107Match-

AND

boschrexrothctrlx_hmi_web_panel_wr2107_firmware

Node

boschrexrothctrlx_hmi_web_panel_wr2110Match-

AND

boschrexrothctrlx_hmi_web_panel_wr2110_firmware

Node

boschrexrothctrlx_hmi_web_panel_wr2115Match-

AND

boschrexrothctrlx_hmi_web_panel_wr2115_firmware

References

psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for NVD:CVE-2023-41372

cvelist1 cve1 prion1