CVE-2025-60036
highpriority · track · 35EPSS 0.004 · 38 %ileEUUSEPSS · scored 2026-10-22
A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running the UA.Testclient.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://psirt.bosch.com/security-advisories/BOSCH-SA-591522.htmlcnnvd
- https://www.boschrexroth.com/en/dc/product-security/security-advisories/Patchcnnvd
- https://psirt.bosch.com/security-advisories/BOSCH-SA-591522.htmlenisa_euvd
- https://psirt.bosch.com/security-advisories/BOSCH-SA-591522.htmlVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan