BOSCH-SA-129652
The base ctrlX OS Setup app contains multiple vulnerabilities. In a worst case scenario, an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup archive, the attacker may have been able to access sensitive data.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-48862US | —OT erhöht | — | ||
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the pr… | ||||
| CVE-2025-48861US | — | — | ||
A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including poten… | ||||
| CVE-2025-48860US | — | — | ||
A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationBosch Rexroth AG ctrlX OS - Setup
When a backup has been created and downloaded, delete the created backup file using the web interface.
- MitigationBosch Rexroth AG ctrlX OS - Setup
When encryption is required for the files contained in the backup, use an external program to encrypt the backup file after the download.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan