CVE-2023-46102 (GCVE-0-2023-46102)

Vulnerability from cvelistv5 – Published: 2023-10-25 14:19 – Updated: 2024-09-11 13:49
VLAI?
Summary
The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application. This issue allows an attacker able to control a malicious MQTT broker on the same subnet network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.
Severity ?
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
Vendor Product Version
Bosch Rexroth AG ctrlX HMI Web Panel - WR21 (WR2107) Affected: all
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:39.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:boschrexrothag:ctrl_hmi_web_panel-wr21_\\(wr2110\\):*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ctrl_hmi_web_panel-wr21_\\(wr2110\\)",
            "vendor": "boschrexrothag",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:boschrexrothag:ctrl_hmi_web_panel-wr21_\\(wr2115\\):*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ctrl_hmi_web_panel-wr21_\\(wr2115\\)",
            "vendor": "boschrexrothag",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:boschrexrothag:ctrl_hmi_web_panel-wr21_\\(wr2107\\):*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ctrl_hmi_web_panel-wr21_\\(wr2107\\)",
            "vendor": "boschrexrothag",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46102",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-11T13:45:20.593751Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T13:49:04.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ctrlX HMI Web Panel - WR21 (WR2107)",
          "vendor": "Bosch Rexroth AG",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "product": "ctrlX HMI Web Panel - WR21 (WR2110)",
          "vendor": "Bosch Rexroth AG",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "product": "ctrlX HMI Web Panel - WR21 (WR2115)",
          "vendor": "Bosch Rexroth AG",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Android Client application, when enrolled to the AppHub server, connects to an MQTT\r\nbroker to exchange messages and receive commands to execute on the HMI device.\r\nThe protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application.\r\n\r\n\r\nThis issue allows an attacker able to control a malicious MQTT broker on the same subnet\r\nnetwork of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-25T14:19:20.107Z",
        "orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
        "shortName": "bosch"
      },
      "references": [
        {
          "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c",
    "assignerShortName": "bosch",
    "cveId": "CVE-2023-46102",
    "datePublished": "2023-10-25T14:19:20.107Z",
    "dateReserved": "2023-10-18T09:35:22.530Z",
    "dateUpdated": "2024-09-11T13:49:04.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FFA1309-DBEE-46F1-B6FD-DAE896180411\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"87C129B8-F100-4D3A-97BC-BAD9A4129F9D\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD47D2E3-F53F-4CE8-BEF7-76F78AEBAF5C\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2110:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"326E80AA-C9B4-4BF1-AA2B-98A3802A72C9\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4CA92486-EEBE-42FD-9755-006B7F2DF361\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2115:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"167C9BC4-FCC5-4FAF-8F75-F967C77400A7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Android Client application, when enrolled to the AppHub server, connects to an MQTT\\r\\nbroker to exchange messages and receive commands to execute on the HMI device.\\r\\nThe protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application.\\r\\n\\r\\n\\r\\nThis issue allows an attacker able to control a malicious MQTT broker on the same subnet\\r\\nnetwork of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.\"}, {\"lang\": \"es\", \"value\": \"La aplicaci\\u00f3n Cliente de Android, cuando se inscribe en el servidor AppHub, se conecta a un intermediario MQTT para intercambiar mensajes y recibir comandos para ejecutar en el dispositivo HMI. El protocolo se basa en MQTT para implementar la administraci\\u00f3n remota del dispositivo y est\\u00e1 cifrado con una clave sim\\u00e9trica DES codificada, que se puede recuperar invirtiendo tanto la aplicaci\\u00f3n cliente de Android como la aplicaci\\u00f3n web del lado del servidor. Este problema permite a un atacante capaz de controlar un agente MQTT malicioso en la misma red de subred del dispositivo, crear mensajes maliciosos y enviarlos al dispositivo HMI, ejecutando comandos arbitrarios en el propio dispositivo.\"}]",
      "id": "CVE-2023-46102",
      "lastModified": "2024-11-21T08:27:54.100",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@bosch.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2023-10-25T18:17:36.033",
      "references": "[{\"url\": \"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\", \"source\": \"psirt@bosch.com\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@bosch.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"psirt@bosch.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-46102\",\"sourceIdentifier\":\"psirt@bosch.com\",\"published\":\"2023-10-25T18:17:36.033\",\"lastModified\":\"2024-11-21T08:27:54.100\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Android Client application, when enrolled to the AppHub server, connects to an MQTT\\r\\nbroker to exchange messages and receive commands to execute on the HMI device.\\r\\nThe protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application.\\r\\n\\r\\n\\r\\nThis issue allows an attacker able to control a malicious MQTT broker on the same subnet\\r\\nnetwork of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n Cliente de Android, cuando se inscribe en el servidor AppHub, se conecta a un intermediario MQTT para intercambiar mensajes y recibir comandos para ejecutar en el dispositivo HMI. El protocolo se basa en MQTT para implementar la administraci\u00f3n remota del dispositivo y est\u00e1 cifrado con una clave sim\u00e9trica DES codificada, que se puede recuperar invirtiendo tanto la aplicaci\u00f3n cliente de Android como la aplicaci\u00f3n web del lado del servidor. Este problema permite a un atacante capaz de controlar un agente MQTT malicioso en la misma red de subred del dispositivo, crear mensajes maliciosos y enviarlos al dispositivo HMI, ejecutando comandos arbitrarios en el propio dispositivo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@bosch.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@bosch.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2107_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FFA1309-DBEE-46F1-B6FD-DAE896180411\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2107:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87C129B8-F100-4D3A-97BC-BAD9A4129F9D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2110_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD47D2E3-F53F-4CE8-BEF7-76F78AEBAF5C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2110:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"326E80AA-C9B4-4BF1-AA2B-98A3802A72C9\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:boschrexroth:ctrlx_hmi_web_panel_wr2115_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CA92486-EEBE-42FD-9755-006B7F2DF361\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:boschrexroth:ctrlx_hmi_web_panel_wr2115:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"167C9BC4-FCC5-4FAF-8F75-F967C77400A7\"}]}]}],\"references\":[{\"url\":\"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\",\"source\":\"psirt@bosch.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\", \"name\": \"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T20:37:39.622Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-46102\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-11T13:45:20.593751Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:boschrexrothag:ctrl_hmi_web_panel-wr21_\\\\(wr2110\\\\):*:*:*:*:*:*:*:*\"], \"vendor\": \"boschrexrothag\", \"product\": \"ctrl_hmi_web_panel-wr21_\\\\(wr2110\\\\)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:boschrexrothag:ctrl_hmi_web_panel-wr21_\\\\(wr2115\\\\):*:*:*:*:*:*:*:*\"], \"vendor\": \"boschrexrothag\", \"product\": \"ctrl_hmi_web_panel-wr21_\\\\(wr2115\\\\)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:boschrexrothag:ctrl_hmi_web_panel-wr21_\\\\(wr2107\\\\):*:*:*:*:*:*:*:*\"], \"vendor\": \"boschrexrothag\", \"product\": \"ctrl_hmi_web_panel-wr21_\\\\(wr2107\\\\)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T13:48:21.164Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Bosch Rexroth AG\", \"product\": \"ctrlX HMI Web Panel - WR21 (WR2107)\", \"versions\": [{\"status\": \"affected\", \"version\": \"all\"}]}, {\"vendor\": \"Bosch Rexroth AG\", \"product\": \"ctrlX HMI Web Panel - WR21 (WR2110)\", \"versions\": [{\"status\": \"affected\", \"version\": \"all\"}]}, {\"vendor\": \"Bosch Rexroth AG\", \"product\": \"ctrlX HMI Web Panel - WR21 (WR2115)\", \"versions\": [{\"status\": \"affected\", \"version\": \"all\"}]}], \"references\": [{\"url\": \"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\", \"name\": \"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Android Client application, when enrolled to the AppHub server, connects to an MQTT\\r\\nbroker to exchange messages and receive commands to execute on the HMI device.\\r\\nThe protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application.\\r\\n\\r\\n\\r\\nThis issue allows an attacker able to control a malicious MQTT broker on the same subnet\\r\\nnetwork of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798 Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"c95f66b2-7e7c-41c5-8f09-6f86ec68659c\", \"shortName\": \"bosch\", \"dateUpdated\": \"2023-10-25T14:19:20.107Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-46102\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-11T13:49:04.787Z\", \"dateReserved\": \"2023-10-18T09:35:22.530Z\", \"assignerOrgId\": \"c95f66b2-7e7c-41c5-8f09-6f86ec68659c\", \"datePublished\": \"2023-10-25T14:19:20.107Z\", \"assignerShortName\": \"bosch\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.