Remote Code Execution Vulnerability in Bosch ctrlX OS
CVE-2025-24339

5MEDIUM

Key Information:

Vendor: Bosch Rexroth Ag
Status: Ctrlx Os - Device Admin
Vendor: CVE Published:; 30 April 2025

🔔 Create Bosch Rexroth Ag Vulnerability Alert

What is CVE-2025-24339?

A vulnerability in the web application of Bosch's ctrlX OS enables a remote unauthenticated attacker to exploit various weaknesses, potentially allowing web cache poisoning and Man-in-the-Middle (MitM) attacks. By sending crafted HTTP requests, attackers can manipulate data and compromise user trust, posing significant risks to system integrity and security. Organizations using affected versions are advised to apply the latest security patches as soon as possible.

Affected Version(s)

ctrlX OS - Device Admin 1.12.0 <= 1.12.9

ctrlX OS - Device Admin 1.20.0 <= 1.20.7

ctrlX OS - Device Admin 2.6.0 <= 2.6.8

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-6404...

vendor-advisory

CVSS V3.1

Score:

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 30, 2025
Vulnerability Reserved
Jan 20, 2025

CVE-2025-24339 Data

JSON