Auth bypass in Bosch Indracontrol_xlc
CVE-2021-23858
Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include…
Vulnerability class: Information Disclosure
EPSS: 0.012 (64.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Bosch Indracontrol_xlc
- Bosch Indracontrol_xlc_firmware
- Bosch Rexroth_indramotion_mlc_l20
- Bosch Rexroth_indramotion_mlc_l20_firmware
- Bosch Rexroth_indramotion_mlc_l25
- Bosch Rexroth_indramotion_mlc_l25_firmware
- Bosch Rexroth_indramotion_mlc_l40
- Bosch Rexroth_indramotion_mlc_l40_firmware
- Bosch Rexroth_indramotion_mlc_l45
- Bosch Rexroth_indramotion_mlc_l45_firmware
Weakness classification (CWE)
References
- psirt@bosch.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-23858?
- CVE-2021-23858 is a high-severity vulnerability in Bosch Indracontrol_xlc, classified under Information Disclosure. CVSS score: 8.6/10. Published 2021-10-04.
- How severe is CVE-2021-23858?
- High severity. CVSS v3 base score is 8.6 out of 10.