Lucene search

BoschCVELIST:CVE-2021-23858

HistoryOct 04, 2021 - 5:32 p.m.

CVE-2021-23858 Information disclosure

2021-10-0417:32:22

CWE-200

bosch

www.cve.org

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.9%

JSON

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

CNA Affected

[
  {
    "product": "IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLC",
    "vendor": "Rexroth",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "12 VRS",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "IndraMotion MLC L20, L40",
    "vendor": "Rexroth",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "12 VRS",
        "versionType": "custom"
      }
    ]
  }
]

References

psirt.bosch.com/security-advisories/bosch-sa-741752.html

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.9%

JSON

Related for CVELIST:CVE-2021-23858