CVE-2023-41255
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 25, 2023
- Updated
- Sep 12, 2024
- Reserved
- Oct 18, 2023
Description
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | bosch |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
ctrlX HMI Web Panel - WR21 (WR2107)Rexroth |
|
ctrlX HMI Web Panel - WR21 (WR2110)Rexroth |
|
ctrlX HMI Web Panel - WR21 (WR2115)Rexroth |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.