CVE-2021-23858
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD
Description
Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.
Affected (12)
Products: Bosch: Rexroth Indramotion Mlc L20 Firmware, Rexroth Indramotion Mlc L40 Firmware, Rexroth Indramotion Mlc L25 Firmware, Rexroth Indramotion Mlc L45 Firmware, Rexroth Indramotion Mlc L65 Firmware, Rexroth Indramotion Mlc L85 Firmware, Rexroth Indramotion Mlc Xm21 Firmware, Rexroth Indramotion Mlc Xm22 Firmware, Rexroth Indramotion Mlc Xm41 Firmware, Rexroth Indramotion Mlc Xm42 Firmware, Indracontrol Xlc Firmware, Rexroth Indramotion Mlc L75 Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc L20 | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc L40 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc L25 | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc L45 | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc L65 | All versions |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc L85 | All versions |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc Xm21 | All versions |
Configuration H
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc Xm22 | All versions |
Configuration I
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc Xm41 | All versions |
Configuration J
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc Xm42 | All versions |
Configuration K
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Indracontrol Xlc | All versions |
Configuration L
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12 |
| Running on/with | Platform Versions |
|---|---|
Bosch Rexroth Indramotion Mlc L75 | All versions |
Related CWEs
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
References (2)
Source: psirt@bosch.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.