Rexroth vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-48266 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a cHigh 8.1 · Jan 10, 2024
• CVE-2023-48265 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a cHigh 8.1 · Jan 10, 2024
• CVE-2023-48264 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a cHigh 8.1 · Jan 10, 2024
• CVE-2023-48263 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a cHigh 8.1 · Jan 10, 2024
• CVE-2023-48262 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a cHigh 8.1 · Jan 10, 2024
• CVE-2023-48257 The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges onHigh 7.8 · Jan 10, 2024
• CVE-2023-48253 The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request.High 8.8 · Jan 10, 2024
• CVE-2023-48252 The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.High 8.8 · Jan 10, 2024
• CVE-2023-48251 The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.High 8.1 · Jan 10, 2024
• CVE-2023-48250 The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.High 8.1 · Jan 10, 2024
• CVE-2023-48243 The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafHigh 8.1 · Jan 10, 2024
• CVE-2023-45220 The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitivHigh 8.8 · Oct 25, 2023
• CVE-2023-43488 The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (AndroHigh 7.9 · Oct 25, 2023
• CVE-2023-41960 The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent applicatioHigh 7.1 · Oct 25, 2023
• CVE-2023-41372 The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducinHigh 7.8 · Oct 25, 2023
• CVE-2023-41255 The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of autHigh 8.8 · Oct 25, 2023
• CVE-2021-23858 Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessedHigh 8.6 · Oct 4, 2021
• CVE-2021-23857 Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password.Critical 10 · Oct 4, 2021
• CVE-2021-23856 The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulaCritical 10 · Oct 4, 2021
• CVE-2021-23855 The user and password data base is exposed by an unprotected web server resource.High 8.6 · Oct 4, 2021