CVE-2023-46102

The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application. This issue allows an attacker able to control a malicious MQTT broker on the same subnet network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2110:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2115:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-10-25 18:17

Updated : 2023-11-06 14:33

NVD link : CVE-2023-46102

Mitre link : CVE-2023-46102

CVE.ORG link : CVE-2023-46102

JSON object : View

Products Affected

boschrexroth

ctrlx_hmi_web_panel_wr2107_firmware
ctrlx_hmi_web_panel_wr2110
ctrlx_hmi_web_panel_wr2107
ctrlx_hmi_web_panel_wr2115_firmware
ctrlx_hmi_web_panel_wr2115
ctrlx_hmi_web_panel_wr2110_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2023-46102", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "psirt@bosch.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-10-25T18:17:36.033", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "psirt@bosch.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Secondary", "source": "psirt@bosch.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The Android Client application, when enrolled to the AppHub server, connects to an MQTT\r\nbroker to exchange messages and receive commands to execute on the HMI device.\r\nThe protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application.\r\n\r\n\r\nThis issue allows an attacker able to control a malicious MQTT broker on the same subnet\r\nnetwork of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself."}, {"lang": "es", "value": "La aplicaci\u00f3n Cliente de Android, cuando se inscribe en el servidor AppHub, se conecta a un intermediario MQTT para intercambiar mensajes y recibir comandos para ejecutar en el dispositivo HMI. El protocolo se basa en MQTT para implementar la administraci\u00f3n remota del dispositivo y est\u00e1 cifrado con una clave sim\u00e9trica DES codificada, que se puede recuperar invirtiendo tanto la aplicaci\u00f3n cliente de Android como la aplicaci\u00f3n web del lado del servidor. Este problema permite a un atacante capaz de controlar un agente MQTT malicioso en la misma red de subred del dispositivo, crear mensajes maliciosos y enviarlos al dispositivo HMI, ejecutando comandos arbitrarios en el propio dispositivo."}], "lastModified": "2023-11-06T14:33:08.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FFA1309-DBEE-46F1-B6FD-DAE896180411"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "87C129B8-F100-4D3A-97BC-BAD9A4129F9D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD47D2E3-F53F-4CE8-BEF7-76F78AEBAF5C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2110:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "326E80AA-C9B4-4BF1-AA2B-98A3802A72C9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CA92486-EEBE-42FD-9755-006B7F2DF361"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2115:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "167C9BC4-FCC5-4FAF-8F75-F967C77400A7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@bosch.com"}