CVE-2023-41255
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to...
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.
- Record
CVE-2023-41255- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2023-45772
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.
- Record
EUVD-2023-45772- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6fhx-rwxq-vh8v
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to...
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.
- Record
GHSA-6fhx-rwxq-vh8v- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
NVD
The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol exposed on the network.
- Record
CVE-2023-41255- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
Affected products
- bosch rexroth ag ctrlx hmi web panel - wr21 (wr2107)
- bosch rexroth ag ctrlx hmi web panel - wr21 (wr2110)
- bosch rexroth ag ctrlx hmi web panel - wr21 (wr2115)
- boschrexroth ctrlx hmi web panel wr2107
- boschrexroth ctrlx hmi web panel wr2107 firmware
- boschrexroth ctrlx hmi web panel wr2110
- boschrexroth ctrlx hmi web panel wr2110 firmware
- boschrexroth ctrlx hmi web panel wr2115
- boschrexroth ctrlx hmi web panel wr2115 firmware
- rexroth ctrlx hmi web panel - wr21 (wr2107)
- rexroth ctrlx hmi web panel - wr21 (wr2110)
- rexroth ctrlx hmi web panel - wr21 (wr2115)
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41255 is a high vulnerability (CVSS 8.8) in Bosch Rexroth Ag Ctrlx Hmi Web Panel - Wr21 (wr2107), published October 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. No source names a fixed version.