CVE-2021-23857
Estado: ModificadaCrítica (9.8)—
Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.23%
- Percentil entre todas las CVEs puntuadas: 68
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (12)
Bosch — Rexroth Indramotion MLC L20 FirmwareBosch — Rexroth Indramotion MLC L25 FirmwareBosch — Rexroth Indramotion MLC L40 FirmwareBosch — Rexroth Indramotion MLC L45 FirmwareBosch — Rexroth Indramotion MLC L65 FirmwareBosch — Rexroth Indramotion MLC L75 FirmwareBosch — Rexroth Indramotion MLC L85 FirmwareBosch — Rexroth Indramotion MLC Xm21 FirmwareBosch — Rexroth Indramotion MLC Xm22 FirmwareBosch — Rexroth Indramotion MLC Xm41 FirmwareBosch — Rexroth Indramotion MLC Xm42 FirmwareBosch — Rexroth Indramotion XLC Firmware
CWE
- CWE-836
- CWE-287
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-23857",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@bosch.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 10,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@bosch.com",
"affectedData": [
{
"vendor": "Rexroth",
"product": "IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion XLC",
"versions": [
{
"status": "affected",
"version": "12 VRS",
"lessThan": "unspecified",
"versionType": "custom"
}
]
},
{
"vendor": "Rexroth",
"product": "IndraMotion MLC L20, L40",
"versions": [
{
"status": "affected",
"version": "12 VRS",
"lessThan": "unspecified",
"versionType": "custom"
}
]
}
]
}
],
"published": "2021-10-04T18:15:07.797",
"references": [
{
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-741752.html",
"tags": [
"Vendor Advisory"
],
"source": "psirt@bosch.com"
},
{
"url": "https://psirt.bosch.com/security-advisories/bosch-sa-741752.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@bosch.com",
"description": [
{
"lang": "en",
"value": "CWE-836"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system."
},
{
"lang": "es",
"value": "Inicio de sesión con hash: La rutina de inicio de sesión permite al cliente iniciar la sesión en el sistema no por usar la contraseña, sino al usar el hash de la contraseña. Combinado con CVE-2021-23858, esto permite a un atacante iniciar posteriormente la sesión en el sistema"
}
],
"lastModified": "2026-06-17T03:38:56.737",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_l20_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E75C9D7-9A6A-43D6-A260-9535673B87AA",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_l20:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B81F392D-9700-415D-A541-7D45035A2C67"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_l40_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4E20554-1346-4F07-A277-38BBC2436E20",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_l40:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "33698277-B03B-4D12-B4E2-F32E3BE8E786"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_l25_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72F2443A-5B3B-46F1-8ECF-93BA2E68D241",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_l25:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "107BE5D1-062D-4D61-AB79-24D8C8FF3055"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_l45_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58B97235-37D0-45A7-8526-F9201D2E4021",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_l45:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "30B3081C-5AB6-41B4-A53F-8C0B521DCE07"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_l65_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C38E88B-69AA-47F5-B3DC-7F78461229BD",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_l65:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "67F66AE1-9551-4E91-9476-D04B06245718"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_l75_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52593B92-03AC-4972-B444-01E6384E3ECC",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_l75:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D0F46438-8E48-4AE8-92B4-6BA66A69BF60"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_l85_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7455F0FF-89D9-4CDA-995E-BE2B64AAC241",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_l85:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1E637053-B9E4-4F91-88D9-FC4039445466"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm22_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "510A903A-B50D-4AB8-91CE-C18ABD7F8998",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm22:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "49FF38C9-2239-4C88-B13B-448B6D38FA0B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm21_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8420BD49-53E1-4467-9371-198967D0E56C",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm21:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "13163AF4-8079-42D7-A68E-AF92E79D11A6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm41_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62D2DB9E-BC01-4FF2-B9E1-110E14EE3CA4",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm41:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B953972B-48C7-40A5-9A6C-6B876B0FF4D1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_mlc_xm42_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "345732C4-1C46-472B-9C74-5BB399A459F4",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_mlc_xm42:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FFD5CE21-DB9C-4221-9C2D-A884622952D5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:bosch:rexroth_indramotion_xlc_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BBDF65CA-43E0-4A26-B472-7AA0E97C6293",
"versionEndIncluding": "12"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:bosch:rexroth_indramotion_xlc:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "19900CD6-4870-4F0C-BA1E-80F33C1DA287"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@bosch.com"
}