CVE-2023-45321

The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user. Due to the lack of encryption of HTTP,this issue allows an attacker placed in the same subnet network of the HMI device to intercept username and password necessary to authenticate to the MQTT server responsible to implement the remote management protocol.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html	Mitigation Vendor Advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2110:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2115:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:26

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-25 18:17

Updated : 2024-11-21 08:26

NVD link : CVE-2023-45321

Mitre link : CVE-2023-45321

CVE.ORG link : CVE-2023-45321

JSON object : View

Products Affected

boschrexroth

ctrlx_hmi_web_panel_wr2110
ctrlx_hmi_web_panel_wr2107
ctrlx_hmi_web_panel_wr2110_firmware
ctrlx_hmi_web_panel_wr2115_firmware
ctrlx_hmi_web_panel_wr2115
ctrlx_hmi_web_panel_wr2107_firmware

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2023-45321", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@bosch.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-10-25T18:17:33.183", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "psirt@bosch.com"}, {"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@bosch.com", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user. Due to the lack of encryption of HTTP,this issue allows an attacker placed in the same subnet network of the HMI device to intercept username and password necessary to authenticate to the MQTT server responsible to implement the remote management protocol."}, {"lang": "es", "value": "La aplicaci\u00f3n Cliente de Android, cuando se inscribe con el m\u00e9todo de definici\u00f3n 1 (el usuario inserta manualmente la direcci\u00f3n IP del servidor), usa el protocolo HTTP para recuperar informaci\u00f3n confidencial (direcci\u00f3n IP y credenciales para conectarse a una entidad de intermediario MQTT remota) en lugar de HTTPS y esta caracter\u00edstica. No es configurable por el usuario. Debido a la falta de cifrado de HTTP, este problema permite que un atacante ubicado en la misma red de subred del dispositivo HMI intercepte el nombre de usuario y la contrase\u00f1a necesarios para autenticarse en el servidor MQTT responsable de implementar el protocolo de administraci\u00f3n remota."}], "lastModified": "2024-11-21T08:26:44.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FFA1309-DBEE-46F1-B6FD-DAE896180411"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "87C129B8-F100-4D3A-97BC-BAD9A4129F9D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD47D2E3-F53F-4CE8-BEF7-76F78AEBAF5C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2110:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "326E80AA-C9B4-4BF1-AA2B-98A3802A72C9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CA92486-EEBE-42FD-9755-006B7F2DF361"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2115:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "167C9BC4-FCC5-4FAF-8F75-F967C77400A7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@bosch.com"}