CVE-2023-45844 Security feature bypass in ctrlX HMI Web Panel - WR21 (WR2107)

High 7.3 Published 25 Oct 2023 Updated 10 Sep 2024

A low-privileged user can bypass Kiosk mode restrictions to install arbitrary apps and access critical device settings on Bosch Rexroth HMI panels.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-45844?

CVE-2023-45844 is a high-severity vulnerability in Rexroth ctrlX HMI Web Panel - WR21 (WR2107), published on 25 Oct 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).

Weakness: CWE-284

Which versions are affected by CVE-2023-45844?

It affects 3 products.

Products include Boschrexroth Ctrlx Hmi Web Panel Wr2107 Firmware, Boschrexroth Ctrlx Hmi Web Panel Wr2110 Firmware, Boschrexroth Ctrlx Hmi Web Panel Wr2115 Firmware.

How do I fix CVE-2023-45844?

No fix has been published for CVE-2023-45844 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-45844 being exploited?

There is no known exploitation of CVE-2023-45844 in the wild and no public exploit code.

Sources

Also known as GHSA-h552-rv29-f87f.