CVE-2023-45321

CVE-2023-45321 describes a critical vulnerability in Bosch Rexroth ctrlX HMI web panels (WR2107, WR2110, WR2115 series firmware and devices). The Android client application, when manually configured with a server IP, insecurely retrieves sensitive MQTT broker credentials over unencrypted HTTP, rather than HTTPS. This allows an attacker on the same local network to intercept usernames and passwords, leading to a high-impact compromise of remote management capabilities. The vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk due to its network-adjacent attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. There is no user configurability to enforce HTTPS, making all manual server IP configurations vulnerable. Currently, there is no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not yet garnered significant public attention.