CVE-2023-45220

HIGH

Bosch Rexroth ctrlX HMI Web Panel WR2107/WR2110/WR2115 - Unauthenticated Sensitive Info Exposure

Title source: llm

Description

The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user.

References (1)

Core 1

Core References

Mitigation, Vendor Advisory vendor-advisory

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

Scores

CVSS v3 8.8

EPSS 0.0039

EPSS Percentile 31.0%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-306

Status published

Products (3)

boschrexroth/ctrlx_hmi_web_panel_wr2107_firmware

boschrexroth/ctrlx_hmi_web_panel_wr2110_firmware

boschrexroth/ctrlx_hmi_web_panel_wr2115_firmware

Published Oct 25, 2023

Tracked Since Feb 18, 2026