ctrlX HMI Web Panel - WR21 (WR2110) vulnerabilities

3 known vulnerabilities in ctrlX HMI Web Panel - WR21 (WR2110) from Bosch Rexroth. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  ctrlX HMI Web Panel - WR21 (WR2107): Use of Hard-coded Credentials

  CVE-2023-46102Oct 25, 2023Bosch Rexroth

  The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encryp

• 8.8 High severity

  ctrlX HMI Web Panel - WR21 (WR2107): Missing Authentication for Critical Functionality

  CVE-2023-45851Oct 25, 2023Bosch Rexroth

  The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it

• 8.8 High severity

  ctrlX HMI Web Panel - WR21 (WR2107): Cleartext Transmission of Sensitive Information

  CVE-2023-45321Oct 25, 2023Bosch Rexroth

  The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTP