CVE-2023-41255

HIGH

Bosch Rexroth ctrlX HMI Web Panel WR2107/WR2110/WR2115 - Unauthenticated Root Access via ADB

Title source: llm
STIX 2.1

Description

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.

References (1)

Core 1
Core References
Mitigation, Vendor Advisory vendor-advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

Scores

CVSS v3 8.8
EPSS 0.0042
EPSS Percentile 33.6%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-306
Status published
Products (3)
boschrexroth/ctrlx_hmi_web_panel_wr2107_firmware
boschrexroth/ctrlx_hmi_web_panel_wr2110_firmware
boschrexroth/ctrlx_hmi_web_panel_wr2115_firmware
Published Oct 25, 2023
Tracked Since Feb 18, 2026