CVE-2021-23858
Last modified
CVE-2021-23858 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.. EPSS estimates a 1.20% chance of exploitation in the next 30 days.
Description
Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bosch | Rexroth Indramotion Mlc L20 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc L40 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc L25 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc L45 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc L65 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc L85 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc Xm21 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc Xm22 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc Xm41 Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc Xm42 Firmware | <= 12 |
| Bosch | Indracontrol Xlc Firmware | <= 12 |
| Bosch | Rexroth Indramotion Mlc L75 Firmware | <= 12 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-23858?
How severe is CVE-2021-23858?
How do I fix CVE-2021-23858?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-23852An authenticated attacker with administrator rights Bosch IP…4.9
- CVE-2021-23853In Bosch IP cameras, improper validation of the HTTP header …9.8
- CVE-2021-23854An error in the handling of a page parameter in Bosch IP cam…6.1
- CVE-2021-23855The user and password data base is exposed by an unprotected…7.5
- CVE-2021-23856The web server is vulnerable to reflected XSS and therefore …6.1
- CVE-2021-23857Login with hash: The login routine allows the client to log …9.8
- CVE-2021-23859An unauthenticated attacker is able to send a special HTTP r…7.5
- CVE-2021-2386Vulnerability in the Primavera P6 Enterprise Project Portfol…4.3
- CVE-2021-23860An error in a page handler of the VRM may lead to a reflecte…6.1
- CVE-2021-23861By executing a special command, an user with administrative …6.5
- CVE-2021-23862A crafted configuration packet sent by an authenticated admi…7.2
- CVE-2021-23863HTML code injection vulnerability in Android Application, Bo…6.1
Are you affected by CVE-2021-23858?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST