CVE-2025-48860

State: Published
Severity: 8.0 High
Published: Aug 14, 2025
Updated: Feb 26, 2026
Reserved: May 27, 2025

Description

A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup archive, the attacker may have been able to access sensitive data.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	bosch

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
ctrlX OS - SetupBosch Rexroth AG	1.20.0 through 1.20.1Affected 2.6.0 through 2.6.1Affected 3.6.0 through 3.6.2Affected

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.