Bosch Rexroth ctrlX HMI Web Panel WR2107
Approved changes feed: RSS · Atom
cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Boschrexroth (ac0c4687-02b6-519a-a673-cbc43fae0631) |
|---|---|
| Product | Ctrlx Hmi Web Panel Wr2107 (6afe7806-6a07-56a2-9078-fd589a1dd851) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-46102 |
not_vulnerable | 2026-06-08 06:12:43.850316 |
Details available
HIGH (8.8)
The Android Client application, when enrolled to the AppHub server, connects to an MQTT
broker to exchange messages and receive commands to execute on the HMI device.
The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application.
This issue allows an attacker able to control a malicious MQTT broker on the same subnet
network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.
Published: 2023-10-25T14:19:20.107Z
Updated: 2024-09-11T13:49:04.787Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45851 |
not_vulnerable | 2026-06-08 06:12:43.454120 |
Details available
HIGH (8.8)
The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.
This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device
Published: 2023-10-25T14:18:08.811Z
Updated: 2024-09-11T18:06:40.524Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45851 |
vulnerable | 2026-06-08 06:12:43.453983 |
Details available
HIGH (8.8)
The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.
This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device
Published: 2023-10-25T14:18:08.811Z
Updated: 2024-09-11T18:06:40.524Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45844 |
not_vulnerable | 2026-06-08 06:12:43.448159 |
Details available
HIGH (7.3)
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).
Published: 2023-10-25T13:07:15.053Z
Updated: 2024-09-10T20:24:25.472Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45321 |
not_vulnerable | 2026-06-08 06:12:42.508422 |
Details available
HIGH (8.3)
The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user. Due to the lack of encryption of HTTP,this issue allows an attacker placed in the same subnet network of the HMI device to intercept username and password necessary to authenticate to the MQTT server responsible to implement the remote management protocol.
Published: 2023-10-25T14:16:41.097Z
Updated: 2024-09-11T18:11:00.080Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45321 |
vulnerable | 2026-06-08 06:12:42.495987 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45220 |
not_vulnerable | 2026-06-08 06:12:42.309860 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45220 |
vulnerable | 2026-06-08 06:12:42.309529 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-43488 |
not_vulnerable | 2026-06-08 06:12:31.677297 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41960 |
not_vulnerable | 2026-06-08 06:11:07.492688 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41960 |
vulnerable | 2026-06-08 06:11:07.492208 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41372 |
not_vulnerable | 2026-06-08 06:11:06.065797 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41372 |
vulnerable | 2026-06-08 06:11:06.065407 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41255 |
not_vulnerable | 2026-06-08 06:11:05.663236 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41255 |
vulnerable | 2026-06-08 06:11:05.658387 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.