CVE-2023-41255

HIGH

8.8

Description

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.

Details CVE

Score CVSS v3.18.8

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueADJACENT_NETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie10/25/2023

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

boschrexroth:ctrlx_hmi_web_panel_wr2107boschrexroth:ctrlx_hmi_web_panel_wr2107_firmwareboschrexroth:ctrlx_hmi_web_panel_wr2110boschrexroth:ctrlx_hmi_web_panel_wr2110_firmwareboschrexroth:ctrlx_hmi_web_panel_wr2115boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware

Faiblesses (CWE)

CWE-306CWE-306

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html(psirt@bosch.com)

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.