Log in Start free

Vulnerability · Published Jan 10, 2024 · Assigned by bosch

CVE-2023-48243

High 8.1

In plain English

A high-severity path traversal in Nexo cordless nutrunner NXA011S-36V (0608842011) from Rexroth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.1%top 34.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.

Affected products (as reported)

VendorProductVersions
Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA030S-36V (0608842002) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA050S-36V (0608842003) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXP012QD-36V (0608842005) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA015S-36V-B (0608842006) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA030S-36V-B (0608842007) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA050S-36V-B (0608842008) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXP012QD-36V-B (0608842010) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA011S-36V (0608842011) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA011S-36V-B (0608842012) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA065S-36V (0608842013) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA065S-36V-B (0608842014) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXV012T-36V (0608842015) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXV012T-36V-B (0608842016) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2272) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2301) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2514) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2515) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2666) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2673) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References