← Back

CVE-2023-45220

nvd nist
Published: Oct 25, 2023Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user.

Affected (3)

Boschrexroth
3 products
Ctrlx Hmi Web Panel Wr2107 Firmware
Ctrlx Hmi Web Panel Wr2110 Firmware
Ctrlx Hmi Web Panel Wr2115 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2107 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2107
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2110 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2110
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2115 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2115
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: psirt@bosch.com
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory

Timeline

No history available yet.