CVE-2023-45851 — Bosch Rexroth AG / ctrlX HMI Web Panel - WR21 (WR2107)

Description (CNA)

The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device

Affected (CNA)

Vendor / product	Versions
Bosch Rexroth AG / ctrlX HMI Web Panel - WR21 (WR2107)	affected all
Bosch Rexroth AG / ctrlX HMI Web Panel - WR21 (WR2110)	affected all
Bosch Rexroth AG / ctrlX HMI Web Panel - WR21 (WR2115)	affected all

CWE

CWE-306

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

ADP enrichment

CVE

No English description supplied.

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

CISA-ADP

No English description supplied.

No references supplied.