CVE-2021-23858

Name: CVE-2021-23858
Creator: NVD / NIST
Published: 2021-10-04T18:15:07.987+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 1.20%

Last modified Jun 17, 2026

CVE-2021-23858 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.. EPSS estimates a 1.20% chance of exploitation in the next 30 days.

Description

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

1.20%

64.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Bosch	Rexroth Indramotion Mlc L20 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc L40 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc L25 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc L45 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc L65 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc L85 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc Xm21 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc Xm22 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc Xm41 Firmware	<= 12
Bosch	Rexroth Indramotion Mlc Xm42 Firmware	<= 12
Bosch	Indracontrol Xlc Firmware	<= 12
Bosch	Rexroth Indramotion Mlc L75 Firmware	<= 12

References

https://psirt.bosch.com/security-advisories/bosch-sa-741752.htmlVendor Advisory
https://psirt.bosch.com/security-advisories/bosch-sa-741752.htmlVendor Advisory

Timeline

Published: Oct 4, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-23858?

How severe is CVE-2021-23858?

CVE-2021-23858 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.20% probability of exploitation in the next 30 days.

How do I fix CVE-2021-23858?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-23858?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST