CVE-2023-45844

MEDIUM

Bosch Rexroth ctrlX HMI Web Panel WR2107/WR2110/WR2115 Firmware - Improper Access Control in Kiosk Mode

Title source: llm

Description

The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).

References (1)

Core 1

Core References

Mitigation, Vendor Advisory vendor-advisory

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

Scores

CVSS v3 6.8

EPSS 0.0034

EPSS Percentile 25.3%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-284

Status published

Products (3)

boschrexroth/ctrlx_hmi_web_panel_wr2107_firmware

boschrexroth/ctrlx_hmi_web_panel_wr2110_firmware

boschrexroth/ctrlx_hmi_web_panel_wr2115_firmware

Published Oct 25, 2023

Tracked Since Feb 18, 2026