CVE-2025-48861

mediumpriority · track · 0EPSS 0.003 · 23 %ileDEEU

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.30% (23rd) EPSS

CVSS 5.3 · medium

Is it mine?

6 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · bosch_psirt

EPSS · scored 2026-10-27

A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · psirt@bosch.comexploitability 3.9 · impact 1.4

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · Bosch PSIRT DE

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284US

affected products (6)

Products and version ranges known to be affected.

Bosch Rexroth Bosch Rexroth AG ctrlX OS - Setup≤ 1.20.0 - 1.20.1bosch_psirtDE
Bosch Rexroth Bosch Rexroth AG ctrlX OS - Setup≤ 2.6.0 - 2.6.1bosch_psirtDE
Bosch Rexroth Bosch Rexroth AG ctrlX OS - Setup≤ 3.6.0 - 3.6.2bosch_psirtDE
Bosch Rexroth AG ctrlX OS - Setup≤ 2.6.0 ≤2.6.1enisa_euvdEU
Bosch Rexroth AG ctrlX OS - Setup≤ 3.6.0 ≤3.6.2enisa_euvdEU
Bosch Rexroth AG ctrlX OS - Setup≤ 1.20.0 ≤1.20.1enisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

BOSCH-SA-129652BOSCH-SA-1296522025-08-14csaf · bosch_psirtDE
The base ctrlX OS Setup app contains multiple vulnerabilities. In a worst case scenario, an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup archive, the attacker may have been able to access sensitive data.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd bosch_psirt NVD CVE.org MITRE

published 2025-08-14modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan