Web Interface Vulnerability in ctrlX OS by Bosch
CVE-2025-48862

7.1HIGH

Key Information:

Vendor

Bosch Rexroth Ag

Status
Ctrlx Os - Setup
Vendor
CVE Published:
14 August 2025

What is CVE-2025-48862?

The web interface of ctrlX OS contains ambiguous wording that may confuse users into thinking that backup files are encrypted when a password is set. However, it is crucial to note that only the private key within the backup is encrypted, while the backup file itself remains unencrypted. This misrepresentation can expose sensitive data if users assume their backups are securely protected.

Affected Version(s)

ctrlX OS - Setup 1.20.0 <= 1.20.1

ctrlX OS - Setup 2.6.0 <= 2.6.1

ctrlX OS - Setup 3.6.0 <= 3.6.2

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-1296...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.