CVEvulnerability

CVE-2023-45220

8.8 HIGH Published 2023-10-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-10-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306

Description

The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user.

Affected configurations

• boschrexroth ctrlx hmi web panel wr2107 firmware • boschrexroth ctrlx hmi web panel wr2110 firmware • boschrexroth ctrlx hmi web panel wr2115 firmware

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References