CVE-2021-23857

high-risk
Published 2021-10-04

Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (12)

Rexroth Indramotion Mlc L20 Firmware
Rexroth Indramotion Mlc L40 Firmware
Rexroth Indramotion Mlc L25 Firmware
Rexroth Indramotion Mlc L45 Firmware
Rexroth Indramotion Mlc L65 Firmware
Rexroth Indramotion Mlc L75 Firmware
Rexroth Indramotion Mlc L85 Firmware
Rexroth Indramotion Mlc Xm22 Firmware
Rexroth Indramotion Mlc Xm21 Firmware
Rexroth Indramotion Mlc Xm41 Firmware
Rexroth Indramotion Mlc Xm42 Firmware
Rexroth Indramotion Xlc Firmware

Affected Vendors

Bosch

References (2)

Vendor Advisory https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
Vendor Advisory https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
51
/ 100
high-risk
Severity 33/34 · Critical
Exploitability 1/34 · Minimal
Exposure 17/34 · Moderate