Manipulation Vulnerability in ctrlX OS Web Application by Bosch
CVE-2025-24345

6.3MEDIUM

Key Information:

Vendor

Bosch Rexroth Ag

Status
Ctrlx Os - Device Admin
Vendor
CVE Published:
30 April 2025

What is CVE-2025-24345?

A vulnerability exists within the Hosts functionality of the ctrlX OS web application, which may allow a remote authenticated attacker with low privileges to alter the hosts file through specially crafted HTTP requests. This can lead to unauthorized operations and potential security breaches if exploited.

Affected Version(s)

ctrlX OS - Device Admin 1.20.0 <= 1.20.7

ctrlX OS - Device Admin 2.6.0 <= 2.6.8

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-6404...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.