CVE-2023-46102 — HIGH (8.8)

Vulnerability Description

The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application. This issue allows an attacker able to control a malicious MQTT broker on the same subnet network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Boschrexroth	Ctrlx Hmi Web Panel Wr2107 Firmware	All versions
Boschrexroth	Ctrlx Hmi Web Panel Wr2107	-
Boschrexroth	Ctrlx Hmi Web Panel Wr2110 Firmware	All versions
Boschrexroth	Ctrlx Hmi Web Panel Wr2110	-
Boschrexroth	Ctrlx Hmi Web Panel Wr2115 Firmware	All versions
Boschrexroth	Ctrlx Hmi Web Panel Wr2115	-

Related Weaknesses (CWE)

CWE-798

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.htmlMitigationVendor Advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.htmlMitigationVendor Advisory

FAQ

What is CVE-2023-46102?

CVE-2023-46102 is a vulnerability with a CVSS score of 8.8 (HIGH). The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of M...

How severe is CVE-2023-46102?

CVE-2023-46102 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-46102?

Check the references section above for vendor advisories and patch information. Affected products include: Boschrexroth Ctrlx Hmi Web Panel Wr2107 Firmware, Boschrexroth Ctrlx Hmi Web Panel Wr2107, Boschrexroth Ctrlx Hmi Web Panel Wr2110 Firmware, Boschrexroth Ctrlx Hmi Web Panel Wr2110, Boschrexroth Ctrlx Hmi Web Panel Wr2115 Firmware.