What is CVE-2023-46102?

CVE-2023-46102 is a high-severity vulnerability in Boschrexroth Ctrlx Hmi Web Panel Wr2107, classified under Use of Hard-coded Credentials. CVSS score: 8.8/10. Published 2023-10-25.

How severe is CVE-2023-46102?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Boschrexroth Ctrlx Hmi Web Panel Wr2107

CVE-2023-46102

The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application. This issue allows an attacker able to control a malicious MQTT broker on the same subnet network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.

Published 2023-10-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.004 (34.6th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 34.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

psirt.bosch.com/security-advisories/BOSCH-SA-175607.html (vendor-advisory, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2023-46102?: CVE-2023-46102 is a high-severity vulnerability in Boschrexroth Ctrlx Hmi Web Panel Wr2107, classified under Use of Hard-coded Credentials. CVSS score: 8.8/10. Published 2023-10-25.
How severe is CVE-2023-46102?: High severity. CVSS v3 base score is 8.8 out of 10.