CVE-2021-23857
Critical
Description
Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.
SeverityCritical
CVSS10.0
Exploit probability—
ProductBosch Rexroth Indramotion Mlc L20 Firmware
PublishedOct 4, 2021
First seenOct 4, 2021
Weakness typeCWE-836CWE-836
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bosch rexroth_indramotion_mlc_l20_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_l40_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_l25_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_l45_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_l65_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_l75_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_l85_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_xm22_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_xm21_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_xm41_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_mlc_xm42_firmware | v ≤ 12 | — |
| bosch rexroth_indramotion_xlc_firmware | v ≤ 12 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.