CVE-2025-48862 - Vulnerability Details - OpenCVE

Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Bosch	Ctrlx Os

No data.

No data.

References

Link	Providers
https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html

History

Sat, 16 Aug 2025 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Bosch Bosch ctrlx Os
Vendors & Products		Bosch Bosch ctrlx Os

Thu, 14 Aug 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 14 Aug 2025 09:15:00 +0000

Type	Values Removed	Values Added
Description		Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.
Weaknesses		CWE-1104 CWE-311
References		https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: bosch

Published: 2025-08-14T09:08:01.853Z

Updated: 2025-08-14T15:46:38.467Z

Reserved: 2025-05-27T10:45:32.638Z

Link: CVE-2025-48862

Vulnrichment

Updated: 2025-08-14T15:46:34.434Z

NVD

Status : Awaiting Analysis

Published: 2025-08-14T09:15:26.293

Modified: 2025-08-14T13:11:53.633

Link: CVE-2025-48862

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-48862", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "state": "PUBLISHED", "assignerShortName": "bosch", "dateReserved": "2025-05-27T10:45:32.638Z", "datePublished": "2025-08-14T09:08:01.853Z", "dateUpdated": "2025-08-14T15:46:38.467Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2025-08-14T09:08:01.853Z"}, "descriptions": [{"lang": "en", "value": "Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key -\u00a0if available in the backup - is encrypted, while the backup file itself remains unencrypted."}], "affected": [{"vendor": "Bosch Rexroth AG", "product": "ctrlX OS - Setup", "versions": [{"version": "1.20.0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "1.20.1"}, {"version": "2.6.0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "2.6.1"}, {"version": "3.6.0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "3.6.2"}]}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "CWE-1104 Use of Unmaintained Third Party Components", "cweId": "CWE-1104"}, {"lang": "en-US", "description": "CWE-311 Missing Encryption of Sensitive Data", "cweId": "CWE-311"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-14T15:46:31.569740Z", "id": "CVE-2025-48862", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T15:46:38.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-48862", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-14T15:46:31.569740Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T15:46:34.434Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Bosch Rexroth AG", "product": "ctrlX OS - Setup", "versions": [{"status": "affected", "version": "1.20.0", "versionType": "custom", "lessThanOrEqual": "1.20.1"}, {"status": "affected", "version": "2.6.0", "versionType": "custom", "lessThanOrEqual": "2.6.1"}, {"status": "affected", "version": "3.6.0", "versionType": "custom", "lessThanOrEqual": "3.6.2"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key -\u00a0if available in the backup - is encrypted, while the backup file itself remains unencrypted."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "cweId": "CWE-1104", "description": "CWE-1104 Use of Unmaintained Third Party Components"}, {"lang": "en-US", "cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2025-08-14T09:08:01.853Z"}}}, "cveMetadata": {"cveId": "CVE-2025-48862", "state": "PUBLISHED", "dateUpdated": "2025-08-14T15:46:38.467Z", "dateReserved": "2025-05-27T10:45:32.638Z", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "datePublished": "2025-08-14T09:08:01.853Z", "assignerShortName": "bosch"}, "dataVersion": "5.1"}