Bosch Rexroth ctrlX OS up to 1.12.9/1.20.7/2.6.8 Proxy /etc/environment improper validation of syntactic correctness of input

Summaryinfo

A vulnerability was found in Bosch Rexroth ctrlX OS up to 1.12.9/1.20.7/2.6.8 and classified as problematic. This issue affects some unknown processing of the file /etc/environment of the component Proxy Handler. The manipulation results in improper validation of syntactic correctness of input. This vulnerability was named CVE-2025-24346. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Bosch Rexroth ctrlX OS up to 1.12.9/1.20.7/2.6.8. It has been classified as problematic. Affected is an unknown code of the file /etc/environment of the component Proxy Handler. The manipulation with an unknown input leads to a improper validation of syntactic correctness of input vulnerability. CWE is classifying the issue as CWE-1286. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file via a crafted HTTP request.

The advisory is available at psirt.bosch.com. This vulnerability is traded as CVE-2025-24346 since 01/20/2025. The exploitability is told to be difficult. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Bosch Rexroth

Name

• ctrlX OS

Version

• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6
• 1.12.7
• 1.12.8
• 1.12.9
• 1.20.0
• 1.20.1
• 1.20.2
• 1.20.3
• 1.20.4
• 1.20.5
• 1.20.6
• 1.20.7
• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion