CVEvulnerability

CVE-2023-45851

8.8 HIGH Published 2023-10-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-10-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306

Description

The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.  This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device

Affected configurations

• boschrexroth ctrlx hmi web panel wr2107 firmware • boschrexroth ctrlx hmi web panel wr2110 firmware • boschrexroth ctrlx hmi web panel wr2115 firmware

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References