Bosch Rexroth ctrlX OS up to 1.12.9/1.20.7/2.6.8 Network Interface improper validation of syntactic correctness of input

Summaryinfo

A vulnerability was found in Bosch Rexroth ctrlX OS up to 1.12.9/1.20.7/2.6.8. It has been classified as critical. Impacted is an unknown function of the component Network Interface. This manipulation causes improper validation of syntactic correctness of input. The identification of this vulnerability is CVE-2025-24347. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Bosch Rexroth ctrlX OS up to 1.12.9/1.20.7/2.6.8. It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Network Interface. The manipulation with an unknown input leads to a improper validation of syntactic correctness of input vulnerability. The CWE definition for the vulnerability is CWE-1286. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network configuration file via a crafted HTTP request.

It is possible to read the advisory at psirt.bosch.com. This vulnerability is known as CVE-2025-24347 since 01/20/2025. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Bosch Rexroth

Name

• ctrlX OS

Version

• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6
• 1.12.7
• 1.12.8
• 1.12.9
• 1.20.0
• 1.20.1
• 1.20.2
• 1.20.3
• 1.20.4
• 1.20.5
• 1.20.6
• 1.20.7
• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion