CVE-2021-23857

Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l20:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l40_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l40:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l25_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l25:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l45_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l45:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l65_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l65:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l75_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l75:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l85_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l85:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm22_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm22:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm21_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm21:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm41_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm41:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm42_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm42:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:bosch:rexroth_indramotion_xlc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_xlc:-:*:*:*:*:*:*:*

History

14 Oct 2021, 18:31

Type Values Removed Values Added
References (CONFIRM) https://psirt.bosch.com/security-advisories/bosch-sa-741752.html - (CONFIRM) https://psirt.bosch.com/security-advisories/bosch-sa-741752.html - Vendor Advisory
CWE CWE-287
CVSS v2 : unknown
v3 : unknown
v2 : 10.0
v3 : 9.8
CPE cpe:2.3:o:bosch:rexroth_indramotion_mlc_l85_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm22:-:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm22_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l45_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_xlc:-:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm41_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm41:-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm21:-:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_xlc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm21_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l65_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l40_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l85:-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l65:-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l40:-:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l25_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l75_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l25:-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm42:-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l45:-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l20:-:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm42_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:bosch:rexroth_indramotion_mlc_l20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bosch:rexroth_indramotion_mlc_l75:-:*:*:*:*:*:*:*

04 Oct 2021, 18:18

Type Values Removed Values Added
New CVE

Information

Published : 2021-10-04 18:15

Updated : 2023-12-10 14:09


NVD link : CVE-2021-23857

Mitre link : CVE-2021-23857

CVE.ORG link : CVE-2021-23857


JSON object : View

Products Affected

bosch

  • rexroth_indramotion_mlc_xm22_firmware
  • rexroth_indramotion_mlc_l85_firmware
  • rexroth_indramotion_mlc_l25_firmware
  • rexroth_indramotion_mlc_l85
  • rexroth_indramotion_mlc_l40_firmware
  • rexroth_indramotion_mlc_l65
  • rexroth_indramotion_xlc
  • rexroth_indramotion_mlc_xm21
  • rexroth_indramotion_mlc_l75
  • rexroth_indramotion_mlc_xm21_firmware
  • rexroth_indramotion_mlc_xm41_firmware
  • rexroth_indramotion_mlc_l20
  • rexroth_indramotion_mlc_l20_firmware
  • rexroth_indramotion_mlc_l40
  • rexroth_indramotion_mlc_l45
  • rexroth_indramotion_mlc_l65_firmware
  • rexroth_indramotion_mlc_l25
  • rexroth_indramotion_mlc_xm42_firmware
  • rexroth_indramotion_mlc_xm22
  • rexroth_indramotion_mlc_xm41
  • rexroth_indramotion_mlc_l45_firmware
  • rexroth_indramotion_mlc_l75_firmware
  • rexroth_indramotion_mlc_xm42
  • rexroth_indramotion_xlc_firmware
CWE
CWE-287

Improper Authentication

CWE-836

Use of Password Hash Instead of Password for Authentication