CVE-2021-23858

Information disclosure

State: Published
Severity: 8.6 High
Published: Oct 4, 2021
Updated: Aug 3, 2024
Reserved: Jan 12, 2021

Description

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	bosch

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLCRexroth	12 VRS to before unspecifiedAffected
IndraMotion MLC L20, L40Rexroth	12 VRS to before unspecifiedAffected

References

https://psirt.bosch.com/security-advisories/bosch-sa-741752.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.