BOSCH-SA-640452
The base ctrlX OS apps Device Admin and Solutions contain multiple vulnerabilities. In a worst case scenario, a remote authenticated (low-privileged) attacker might be able to execute arbitrary OS commands running with higher privileges. The vulnerabilities have been uncovered and disclosed responsibly by Nozomi. We thank them for making a responsible disclosure with us.
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-27532US | —OT elevated | — | ||
A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via m… | ||||
| CVE-2025-24351US | — | — | ||
A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arbitrary OS commands in… | ||||
| CVE-2025-24350US | — | — | ||
A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary certifica… | ||||
| CVE-2025-24349US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete the configuration of p… | ||||
| CVE-2025-24348US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the wireless netw… | ||||
| CVE-2025-24347US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network confi… | ||||
| CVE-2025-24346US | — | — | ||
A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file via… | ||||
| CVE-2025-24345US | — | — | ||
A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “hosts” file in an uninten… | ||||
| CVE-2025-24344US | — | — | ||
A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute… | ||||
| CVE-2025-24343US | — | — | ||
A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary files in arbit… | ||||
| CVE-2025-24342US | — | — | ||
A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests. | ||||
| CVE-2025-24341US | — | — | ||
A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the device via multiple… | ||||
| CVE-2025-24340US | — | — | ||
A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users. | ||||
| CVE-2025-24339US | — | — | ||
A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache p… | ||||
| CVE-2025-24338US | — | — | ||
A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to execute arbitrary client-side c… | ||||
references
External citations — patches, advisories, analysis.
remediations (15)
- MitigationBosch Rexroth AG ctrlX OS
Make sure that all links are verified before clicking them and always access ctrlX OS using the secure https address, only
- MitigationBosch Rexroth AG ctrlX OS
Make sure that artefacts are coming from a trustworthy source before uploading them to ctrlX OS
- MitigationBosch Rexroth AG ctrlX OS
Make sure that for all user accounts strong password policies are set so that even when an attacker is able to determine that a specific account exists, brute-forcing the password is not feasible
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
- MitigationBosch Rexroth AG ctrlX OS
Updated versions of the affected components are available for all LTS releases. The user is strongly recommended to update to the latest versions. The update of the apps might require a reboot of the device and the device will therefore temporarily become unavailable. To verify that the updated versions are installed, please check the version by using the package management of the device.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan