{"id":"CVE-2023-41255","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-41255","generatedAt":"2026-10-28T02:14:49.766Z","title":"The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the…","description":"The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication \r\nof the ‘su’ binary file installed on the device that can be accessed through the ADB (Android Debug Bridge) protocol  exposed on the network.","published":"2023-10-25T18:17:31.000Z","lastModified":"2026-06-17T06:21:23.000Z","status":"Modified","sourceIdentifier":"psirt@bosch.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-306"],"affected":["boschrexroth/ctrlx hmi web panel wr2107 firmware","boschrexroth/ctrlx hmi web panel wr2110 firmware","boschrexroth/ctrlx hmi web panel wr2115 firmware"],"epss":{"score":0.00486,"percentile":0.41568,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html","tags":["Mitigation","Vendor Advisory"],"source":"psirt@bosch.com"},{"url":"https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html","tags":["Mitigation","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-41255","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}