← Back

CVE-2023-41255

nvd nist
Published: Oct 25, 2023Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.

Affected (3)

Boschrexroth
3 products
Ctrlx Hmi Web Panel Wr2107 Firmware
Ctrlx Hmi Web Panel Wr2110 Firmware
Ctrlx Hmi Web Panel Wr2115 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2107 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2107
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2110 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2110
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2115 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2115
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: psirt@bosch.com
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory

Timeline

No history available yet.