Vulnerability · Published Aug 14, 2025 · Assigned by bosch
CVE-2025-48862
High 7.1
In plain English
A high-severity security flaw in ctrlX OS - Setup from Bosch Rexroth AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch Rexroth AG | ctrlX OS - Setup | 1.20.0 – through 1.20.12.6.0 – through 2.6.13.6.0 – through 3.6.2 |
Weakness: CWE-1104, CWE-311 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html vendor-advisory