CVE-2021-23858: high-severity vulnerability in Rexroth IndraMotion MLC L20, L40
Information disclosure
Published · Updated
Follow this CVE+ Monitor IndraMotion MLC L20, L40+ Monitor IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLC
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 1.2%
Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
Rexroth · IndraMotion MLC L20, L40Rexroth · IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLCRelated CVEs — Rexroth IndraMotion MLC L20, L40
In the same product, most dangerous first.