CVE-2021-23858

moderate-risk
Published 2021-10-04

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

Do I need to act?

-
0.24% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.6/10 High
NETWORK / LOW complexity

Affected Products (12)

Rexroth Indramotion Mlc L20 Firmware
Rexroth Indramotion Mlc L40 Firmware
Rexroth Indramotion Mlc L25 Firmware
Rexroth Indramotion Mlc L45 Firmware
Rexroth Indramotion Mlc L65 Firmware
Rexroth Indramotion Mlc L85 Firmware
Rexroth Indramotion Mlc Xm21 Firmware
Rexroth Indramotion Mlc Xm22 Firmware
Rexroth Indramotion Mlc Xm41 Firmware
Rexroth Indramotion Mlc Xm42 Firmware
Indracontrol Xlc Firmware
Rexroth Indramotion Mlc L75 Firmware

Affected Vendors

Bosch

References (2)

Vendor Advisory https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
Vendor Advisory https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
47
/ 100
moderate-risk
Severity 29/34 · Critical
Exploitability 1/34 · Minimal
Exposure 17/34 · Moderate