CVE-2023-41372

The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcoded RSA key pair

Score

CVSS 3.1 7.8 High

Status

Modified - psirt@bosch.com

Published

2023-10-25

Last modified

2024-09-12

Weaknesses

CWE-798

Affected products

• Ctrlx Hmi Web Panel Wr2107 (Boschrexroth)
• Ctrlx Hmi Web Panel Wr2107 Firmware (Boschrexroth)
• Ctrlx Hmi Web Panel Wr2110 (Boschrexroth)
• Ctrlx Hmi Web Panel Wr2110 Firmware (Boschrexroth)
• Ctrlx Hmi Web Panel Wr2115 (Boschrexroth)
• Ctrlx Hmi Web Panel Wr2115 Firmware (Boschrexroth)
• Ctrlx Hmi Web Panel - Wr21 Wr2107 (Rexroth)
• Ctrlx Hmi Web Panel - Wr21 Wr2110 (Rexroth)
• Ctrlx Hmi Web Panel - Wr21 Wr2115 (Rexroth)

References

• https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html