File Writing Vulnerability in ctrlX OS by Bosch
CVE-2025-24343

5.4MEDIUM

Key Information:

Vendor

Bosch Rexroth Ag

Status
Ctrlx Os - Solutions
Vendor
CVE Published:
30 April 2025

What is CVE-2025-24343?

A security flaw in the 'Manages app data' functionality of the ctrlX OS web application allows a low-privileged remote authenticated attacker to exploit this weakness. By crafting a specific HTTP request, the attacker can write arbitrary files in any designated file system path. This can lead to unauthorized data access or manipulation, posing significant risks to system integrity and confidentiality.

Affected Version(s)

ctrlX OS - Solutions 1.12.0 <= 1.12.1

ctrlX OS - Solutions 1.20.0 <= 1.20.1

ctrlX OS - Solutions 2.6.0

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-6404...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.