CVE-2023-41372 is a high-severity vulnerability (CVSS 7.8) affecting Bosch Rexroth ctrlX HMI Web Panel products. It allows an unprivileged third-party application to modify the Android Client's server settings, redirecting it to an attacker-controlled malicious server by forging a broadcast intent encrypted with a hardcoded RSA key. This local attack vector requires low complexity and user interaction, leading to high impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Multiple vulnerabilities on ctrlX HMI / WR21
Oct 20, 2023Multiple vulnerabilities on ctrlX HMI / WR21
Oct 20, 2023Multiple vulnerabilities on ctrlX HMI / WR21
Oct 20, 2023Multiple vulnerabilities on ctrlX HMI / WR21
Oct 20, 2023