CVE-2023-45851

HIGH

Bosch Rexroth ctrlX HMI Web Panel WR2107/WR2110/WR2115 Firmware - Missing Authentication for MQTT Broker Connection

Title source: llm
STIX 2.1

Description

The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.  This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device

References (1)

Core 1
Core References
Mitigation, Vendor Advisory vendor-advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html

Scores

CVSS v3 8.8
EPSS 0.0045
EPSS Percentile 35.5%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-306
Status published
Products (3)
boschrexroth/ctrlx_hmi_web_panel_wr2107_firmware
boschrexroth/ctrlx_hmi_web_panel_wr2110_firmware
boschrexroth/ctrlx_hmi_web_panel_wr2115_firmware
Published Oct 25, 2023
Tracked Since Feb 18, 2026