CVEvulnerability

CVE-2021-23857

9.8 CRITICAL Published 2021-10-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-10-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-287, CWE-836

Description

Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.

Affected configurations

• bosch rexroth indramotion mlc l20 firmware (<= 12) • bosch rexroth indramotion mlc l40 firmware (<= 12) • bosch rexroth indramotion mlc l25 firmware (<= 12) • bosch rexroth indramotion mlc l45 firmware (<= 12) • bosch rexroth indramotion mlc l65 firmware (<= 12) • bosch rexroth indramotion mlc l75 firmware (<= 12) • bosch rexroth indramotion mlc l85 firmware (<= 12) • bosch rexroth indramotion mlc xm22 firmware (<= 12) • bosch rexroth indramotion mlc xm21 firmware (<= 12) • bosch rexroth indramotion mlc xm41 firmware (<= 12) • bosch rexroth indramotion mlc xm42 firmware (<= 12) • bosch rexroth indramotion xlc firmware (<= 12)

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-836 Use of Password Hash Instead of Password for Authentication weakness

References