CVE-2023-41255 HIGH

CVE-2023-41255

Vendor Rexroth
Product ctrlX HMI Web Panel - WR21 (WR2107)
Weakness CWE-306 · Missing auth
Published October 25, 2023
Last update September 12, 2024

CVSS base score

8.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.

Key dates

02Disclosure timeline

October 25, 2023 CVE published
September 12, 2024 Record updated