Main Vulnerability Database Vulnerabilities #VU82362

Improper access control in Bosch Rexroth products - #VU82362

Published: October 25, 2023

Vulnerability identifier: #VU82362

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when the Kiosk mode is used in conjunction with Google Chrome. An attacker with physical access can bypass implemented security restrictions and gain full root access.

Affected software

ctrlX WR21 HMI - WR21 (WR2107)
ctrlX WR21 HMI - WR21 (WR2110)
ctrlX WR21 HMI - WR21 (WR2115)

Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External References

https://psirt.bosch.com/security-advisories/bosch-sa-175607.html

Related Security Bulletins