← Back

CVE-2023-45851

nvd nist
Published: Oct 25, 2023Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.  This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device

Affected (3)

Boschrexroth
3 products
Ctrlx Hmi Web Panel Wr2107 Firmware
Ctrlx Hmi Web Panel Wr2110 Firmware
Ctrlx Hmi Web Panel Wr2115 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2107 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2107
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2110 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2110
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ctrlx Hmi Web Panel Wr2115 Firmware
All versions
Running on/withPlatform Versions
Boschrexroth
Ctrlx Hmi Web Panel Wr2115
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: psirt@bosch.com
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory

Timeline

No history available yet.