Skip to content
OpenAdvisories
High · 7.8 CVE-2023-41372 EUVD-2023-45874GHSA-5q5g-gj85-746p

The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client…

Published Oct 25, 2023 · Updated Sep 12, 2024 · Assigned by bosch

Vendor: Rexroth Product: ctrlX HMI Web Panel - WR21 (WR2107) Product: ctrlX HMI Web Panel - WR21 (WR2110) Product: ctrlX HMI Web Panel - WR21 (WR2115)

Description

The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcoded RSA key pair

Affected products

VendorProductAffectedFixed
Rexroth ctrlX HMI Web Panel - WR21 (WR2107) all —
Rexroth ctrlX HMI Web Panel - WR21 (WR2110) all —
Rexroth ctrlX HMI Web Panel - WR21 (WR2115) all —

References