CVE-2021-23858

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-306

Affected software

Vendor	Product	Versions
Rexroth	IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLC	>= 12 VRS, < unspecified
Rexroth	IndraMotion MLC L20, L40	>= 12 VRS, < unspecified

References

https://psirt.bosch.com/security-advisories/bosch-sa-741752.htmlVendor Advisory
https://psirt.bosch.com/security-advisories/bosch-sa-741752.htmlVendor Advisory

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-238597.5An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with CVE-2021-23864.3Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Acc CVE-2021-238606.1An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnera CVE-2021-238616.5By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an imp CVE-2021-238627.2A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. Thi CVE-2021-238636.1HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allow CVE-2021-23874.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 an CVE-2021-238727.8Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain CVE-2021-238736.1Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and per CVE-2021-238747.8Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges CVE-2021-238767.8Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform a CVE-2021-238777.8Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user