Bosch PSIRT (CSAF)
advisoryDEbosch_psirt
Bosch PSIRT CSAF 2.0 advisories (crawled from the PSIRT sitemap; Bosch publishes no feed).
01
advisories (5)
Vendor and ecosystem advisories describing this.
02
product assertions (9)
Products and version ranges known to be affected.
- Bosch Rexroth AG PRI7000
- Bosch Rexroth AG PRI7000
- Bosch Rexroth Bosch Rexroth AG R-IL ETH BK DI8 DO4 2TX-PAC (R911171726)
- Bosch Rexroth Bosch Rexroth AG S20-EIP-BK (R911173904)
- Bosch Rexroth Bosch Rexroth AG S20-ETH-BK (R911173905)
- Bosch Rexroth Bosch Rexroth AG S20-PN-BK+ (R911173359)
- Bosch Rexroth Bosch Rexroth AG ctrlX OS
- Bosch Rexroth Bosch Rexroth AG ctrlX OS - Setup
- Bosch Rexroth AG PRI7000
03
CVE links (21)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-14266US | high7.8 | Exploit | ||
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… | ||||
| CVE-2026-48095US | — | Exploit | ||
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed s… | ||||
| CVE-2025-48862US | —OT elevated | — | ||
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the pr… | ||||
| CVE-2025-48861US | — | — | ||
A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including poten… | ||||
| CVE-2025-48860US | — | — | ||
A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a… | ||||
| CVE-2025-2813US | — | — | ||
An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. | ||||
| CVE-2025-27532US | —OT elevated | — | ||
A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via m… | ||||
| CVE-2025-24351US | — | — | ||
A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arbitrary OS commands in… | ||||
| CVE-2025-24350US | — | — | ||
A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary certifica… | ||||
| CVE-2025-24349US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete the configuration of p… | ||||
| CVE-2025-24348US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the wireless netw… | ||||
| CVE-2025-24347US | — | — | ||
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network confi… | ||||
| CVE-2025-24346US | — | — | ||
A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file via… | ||||
| CVE-2025-24345US | — | — | ||
A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “hosts” file in an uninten… | ||||
| CVE-2025-24344US | — | — | ||
A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute… | ||||
| CVE-2025-24343US | — | — | ||
A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary files in arbit… | ||||
| CVE-2025-24342US | — | — | ||
A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests. | ||||
| CVE-2025-24341US | — | — | ||
A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the device via multiple… | ||||
| CVE-2025-24340US | — | — | ||
A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users. | ||||
| CVE-2025-24339US | — | — | ||
A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache p… | ||||
showing 20 of 21