CVE-2021-23858

HIGH

8.6

Description

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

CVE Details

CVSS v3.1 Score8.6

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published10/4/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

bosch:indracontrol_xlcbosch:indracontrol_xlc_firmwarebosch:rexroth_indramotion_mlc_l20bosch:rexroth_indramotion_mlc_l20_firmwarebosch:rexroth_indramotion_mlc_l25bosch:rexroth_indramotion_mlc_l25_firmwarebosch:rexroth_indramotion_mlc_l40bosch:rexroth_indramotion_mlc_l40_firmwarebosch:rexroth_indramotion_mlc_l45bosch:rexroth_indramotion_mlc_l45_firmwarebosch:rexroth_indramotion_mlc_l65bosch:rexroth_indramotion_mlc_l65_firmwarebosch:rexroth_indramotion_mlc_l75bosch:rexroth_indramotion_mlc_l75_firmwarebosch:rexroth_indramotion_mlc_l85bosch:rexroth_indramotion_mlc_l85_firmwarebosch:rexroth_indramotion_mlc_xm21bosch:rexroth_indramotion_mlc_xm21_firmwarebosch:rexroth_indramotion_mlc_xm22bosch:rexroth_indramotion_mlc_xm22_firmwarebosch:rexroth_indramotion_mlc_xm41bosch:rexroth_indramotion_mlc_xm41_firmwarebosch:rexroth_indramotion_mlc_xm42bosch:rexroth_indramotion_mlc_xm42_firmware

Weaknesses (CWE)

CWE-200CWE-306

References

https://psirt.bosch.com/security-advisories/bosch-sa-741752.html(psirt@bosch.com)

https://psirt.bosch.com/security-advisories/bosch-sa-741752.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.