Search
Find a vulnerability
Search criteria
2 vulnerabilities found for ctrlx_hmi_web_panel_wr21\/wr2115\/ by rexroth
CVE-2023-45844 (GCVE-0-2023-45844)
Vulnerability from nvd – Published: 2023-10-25 13:07 – Updated: 2024-09-10 20:24
VLAI
EPSS
VEX
Summary
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 20:05 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.bosch.com/security-advisories/BOSCH… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2107) |
Affected:
all
|
|
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2110) |
Affected:
all
|
|
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2115) |
Affected:
all
|
|
| rexroth | ctrlx_hmi_web_panel_wr21\/wr2107\/ |
Affected:
0 , ≤ *
(custom)
cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\/wr2107\/:*:*:*:*:*:*:*:* |
|
| rexroth | ctrlx_hmi_web_panel_wr21\/wr2110\/ |
Affected:
0 , ≤ *
(custom)
cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\/wr2110\/:*:*:*:*:*:*:*:* |
|
| rexroth | ctrlx_hmi_web_panel_wr21\/wr2115\/ |
Affected:
0 , ≤ *
(custom)
cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\/wr2115\/:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:29:32.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2107\\/:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ctrlx_hmi_web_panel_wr21\\/wr2107\\/",
"vendor": "rexroth",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2110\\/:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ctrlx_hmi_web_panel_wr21\\/wr2110\\/",
"vendor": "rexroth",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2115\\/:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ctrlx_hmi_web_panel_wr21\\/wr2115\\/",
"vendor": "rexroth",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-45844",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T20:05:44.966105Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T20:24:25.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ctrlX HMI Web Panel - WR21 (WR2107)",
"vendor": "Rexroth",
"versions": [
{
"status": "affected",
"version": "all"
}
]
},
{
"product": "ctrlX HMI Web Panel - WR21 (WR2110)",
"vendor": "Rexroth",
"versions": [
{
"status": "affected",
"version": "all"
}
]
},
{
"product": "ctrlX HMI Web Panel - WR21 (WR2115)",
"vendor": "Rexroth",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug)."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-25T13:07:15.053Z",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html",
"tags": [
"vendor-advisory"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2023-45844",
"datePublished": "2023-10-25T13:07:15.053Z",
"dateReserved": "2023-10-18T09:35:22.486Z",
"dateUpdated": "2024-09-10T20:24:25.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-45844 (GCVE-0-2023-45844)
Vulnerability from cvelistv5 – Published: 2023-10-25 13:07 – Updated: 2024-09-10 20:24
VLAI
EPSS
VEX
Summary
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 20:05 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.bosch.com/security-advisories/BOSCH… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2107) |
Affected:
all
|
|
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2110) |
Affected:
all
|
|
| Rexroth | ctrlX HMI Web Panel - WR21 (WR2115) |
Affected:
all
|
|
| rexroth | ctrlx_hmi_web_panel_wr21\/wr2107\/ |
Affected:
0 , ≤ *
(custom)
cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\/wr2107\/:*:*:*:*:*:*:*:* |
|
| rexroth | ctrlx_hmi_web_panel_wr21\/wr2110\/ |
Affected:
0 , ≤ *
(custom)
cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\/wr2110\/:*:*:*:*:*:*:*:* |
|
| rexroth | ctrlx_hmi_web_panel_wr21\/wr2115\/ |
Affected:
0 , ≤ *
(custom)
cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\/wr2115\/:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:29:32.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2107\\/:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ctrlx_hmi_web_panel_wr21\\/wr2107\\/",
"vendor": "rexroth",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2110\\/:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ctrlx_hmi_web_panel_wr21\\/wr2110\\/",
"vendor": "rexroth",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2115\\/:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ctrlx_hmi_web_panel_wr21\\/wr2115\\/",
"vendor": "rexroth",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-45844",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T20:05:44.966105Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T20:24:25.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ctrlX HMI Web Panel - WR21 (WR2107)",
"vendor": "Rexroth",
"versions": [
{
"status": "affected",
"version": "all"
}
]
},
{
"product": "ctrlX HMI Web Panel - WR21 (WR2110)",
"vendor": "Rexroth",
"versions": [
{
"status": "affected",
"version": "all"
}
]
},
{
"product": "ctrlX HMI Web Panel - WR21 (WR2115)",
"vendor": "Rexroth",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug)."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-25T13:07:15.053Z",
"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"shortName": "bosch"
},
"references": [
{
"name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html",
"tags": [
"vendor-advisory"
],
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
"assignerShortName": "bosch",
"cveId": "CVE-2023-45844",
"datePublished": "2023-10-25T13:07:15.053Z",
"dateReserved": "2023-10-18T09:35:22.486Z",
"dateUpdated": "2024-09-10T20:24:25.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}