Log in Start free

Vulnerability · Published Jan 10, 2024 · Assigned by bosch

CVE-2023-48257

High 7.8

In plain English

A high-severity security flaw in Nexo cordless nutrunner NXA011S-36V (0608842011) from Rexroth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 54.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.

Affected products (as reported)

VendorProductVersions
Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA030S-36V (0608842002) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA050S-36V (0608842003) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXP012QD-36V (0608842005) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA015S-36V-B (0608842006) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA030S-36V-B (0608842007) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA050S-36V-B (0608842008) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXP012QD-36V-B (0608842010) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA011S-36V (0608842011) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA011S-36V-B (0608842012) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA065S-36V (0608842013) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXA065S-36V-B (0608842014) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXV012T-36V (0608842015) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo cordless nutrunner NXV012T-36V-B (0608842016) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2272) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2301) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2514) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2515) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2666) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2
Rexroth Nexo special cordless nutrunner (0608PE2673) NEXO-OS V1000-Release – through NEXO-OS V1500-SP2

Weakness: CWE-1391 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References