CVE-2023-45844

Published: Oct 25, 2023Modified: Nov 21, 2024

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).

Affected (3)

Products: Boschrexroth: Ctrlx Hmi Web Panel Wr2107 Firmware, Ctrlx Hmi Web Panel Wr2110 Firmware, Ctrlx Hmi Web Panel Wr2115 Firmware

Boschrexroth

3 products

Ctrlx Hmi Web Panel Wr2107 Firmware

Ctrlx Hmi Web Panel Wr2110 Firmware

Ctrlx Hmi Web Panel Wr2115 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Boschrexroth Ctrlx Hmi Web Panel Wr2107 Firmware	All versions

Running on/with	Platform Versions
Boschrexroth Ctrlx Hmi Web Panel Wr2107	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Boschrexroth Ctrlx Hmi Web Panel Wr2110 Firmware	All versions

Running on/with	Platform Versions
Boschrexroth Ctrlx Hmi Web Panel Wr2110	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Boschrexroth Ctrlx Hmi Web Panel Wr2115 Firmware	All versions

Running on/with	Platform Versions
Boschrexroth Ctrlx Hmi Web Panel Wr2115	All versions

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

Source: psirt@bosch.com

MitigationVendor Advisory

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.