CVE-2021-23857

State: Published
Severity: 10.0 Critical
Published: Oct 4, 2021
Updated: Aug 3, 2024
Reserved: Jan 12, 2021

Description

Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	bosch

Weaknesses

CWE-836 Use of Password Hash Instead of Password for Authentication

Affected Products

Product	Versions
IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion XLCRexroth	12 VRS to before unspecifiedAffected
IndraMotion MLC L20, L40Rexroth	12 VRS to before unspecifiedAffected

References

https://psirt.bosch.com/security-advisories/bosch-sa-741752.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.