High severity · published Oct 25, 2023
CVE-2023-43488
The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (Android Debug Bridge)…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
The vulnerability allows a low privileged (untrusted) application to
modify a critical system property that should be denied, in order to enable the ADB (Android Debug Bridge) protocol to be exposed on the network, exploiting it to gain a privileged shell on the device without requiring the physical access through USB.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
ctrlX HMI Web Panel - WR21 (WR2107) · Rexroth
All versions, or not specified · source: vendor
CH
ctrlX HMI Web Panel - WR21 (WR2110) · Rexroth
All versions, or not specified · source: vendor
CH
ctrlX HMI Web Panel - WR21 (WR2115) · Rexroth
All versions, or not specified · source: vendor
CH
Ctrlx Hmi Web Panel Wr2107 Firmware · Boschrexroth
All versions, or not specified · source: NVD
CH
Ctrlx Hmi Web Panel Wr2110 Firmware · Boschrexroth
All versions, or not specified · source: NVD
CH
Ctrlx Hmi Web Panel Wr2115 Firmware · Boschrexroth
All versions, or not specified · source: NVD
Affected product
CH
ctrlX HMI Web Panel - WR21 (WR2107)
Rexroth
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43488
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43488
Mitigation
https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
More from ctrlX HMI Web Panel - WR21 (WR2107)
8.8
CVE-2023-45220
The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip…
8.8
CVE-2023-41255
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of…
7.8
CVE-2023-41372
The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to…
6.8
CVE-2023-45844
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access…
3.3
CVE-2023-41960
The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially…