{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45844", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "state": "PUBLISHED", "assignerShortName": "bosch", "dateReserved": "2023-10-18T09:35:22.486Z", "datePublished": "2023-10-25T13:07:15.053Z", "dateUpdated": "2024-09-10T20:24:25.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2023-10-25T13:07:15.053Z"}, "descriptions": [{"lang": "en", "value": "The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug)."}], "affected": [{"vendor": "Rexroth", "product": "ctrlX HMI Web Panel - WR21 (WR2107)", "versions": [{"version": "all", "status": "affected"}]}, {"vendor": "Rexroth", "product": "ctrlX HMI Web Panel - WR21 (WR2110)", "versions": [{"version": "all", "status": "affected"}]}, {"vendor": "Rexroth", "product": "ctrlX HMI Web Panel - WR21 (WR2115)", "versions": [{"version": "all", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.423Z"}, "title": "CVE Program Container", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "tags": ["vendor-advisory", "x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "affected": [{"vendor": "rexroth", "product": "ctrlx_hmi_web_panel_wr21\\/wr2107\\/", "cpes": ["cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2107\\/:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "rexroth", "product": "ctrlx_hmi_web_panel_wr21\\/wr2110\\/", "cpes": ["cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2110\\/:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "rexroth", "product": "ctrlx_hmi_web_panel_wr21\\/wr2115\\/", "cpes": ["cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2115\\/:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-10T20:05:44.966105Z", "id": "CVE-2023-45844", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-10T20:24:25.472Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.423Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-45844", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-10T20:05:44.966105Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2107\\/:*:*:*:*:*:*:*:*"], "vendor": "rexroth", "product": "ctrlx_hmi_web_panel_wr21\\/wr2107\\/", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2110\\/:*:*:*:*:*:*:*:*"], "vendor": "rexroth", "product": "ctrlx_hmi_web_panel_wr21\\/wr2110\\/", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:rexroth:ctrlx_hmi_web_panel_wr21\\/wr2115\\/:*:*:*:*:*:*:*:*"], "vendor": "rexroth", "product": "ctrlx_hmi_web_panel_wr21\\/wr2115\\/", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-10T20:20:29.121Z"}}], "cna": {"metrics": [{"cvssV3_0": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Rexroth", "product": "ctrlX HMI Web Panel - WR21 (WR2107)", "versions": [{"status": "affected", "version": "all"}]}, {"vendor": "Rexroth", "product": "ctrlX HMI Web Panel - WR21 (WR2110)", "versions": [{"status": "affected", "version": "all"}]}, {"vendor": "Rexroth", "product": "ctrlX HMI Web Panel - WR21 (WR2115)", "versions": [{"status": "affected", "version": "all"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2023-10-25T13:07:15.053Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45844", "state": "PUBLISHED", "dateUpdated": "2024-09-10T20:24:25.472Z", "dateReserved": "2023-10-18T09:35:22.486Z", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "datePublished": "2023-10-25T13:07:15.053Z", "assignerShortName": "bosch"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*", "matchCriteriaId": "87C129B8-F100-4D3A-97BC-BAD9A4129F9D", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FFA1309-DBEE-46F1-B6FD-DAE896180411", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2110:-:*:*:*:*:*:*:*", "matchCriteriaId": "326E80AA-C9B4-4BF1-AA2B-98A3802A72C9", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD47D2E3-F53F-4CE8-BEF7-76F78AEBAF5C", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2115:-:*:*:*:*:*:*:*", "matchCriteriaId": "167C9BC4-FCC5-4FAF-8F75-F967C77400A7", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA92486-EEBE-42FD-9755-006B7F2DF361", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug)."}, {"lang": "es", "value": "La vulnerabilidad permite a un usuario con pocos privilegios que tiene acceso al dispositivo cuando est\u00e1 bloqueado en modo quiosco instalar una aplicaci\u00f3n Android arbitraria y aprovecharla para tener acceso a configuraciones cr\u00edticas del dispositivo, como la administraci\u00f3n de energ\u00eda del dispositivo o, eventualmente, la configuraci\u00f3n segura del dispositivo (depuraci\u00f3n ADB). ."}], "id": "CVE-2023-45844", "lastModified": "2024-09-10T21:35:06.907", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.7, "impactScore": 6.0, "source": "psirt@bosch.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-25T18:17:35.347", "references": [{"source": "psirt@bosch.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html"}], "sourceIdentifier": "psirt@bosch.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@bosch.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}