CVE-2025-48862

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-48862", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "state": "PUBLISHED", "assignerShortName": "bosch", "dateReserved": "2025-05-27T10:45:32.638Z", "datePublished": "2025-08-14T09:08:01.853Z", "dateUpdated": "2025-08-14T15:46:38.467Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2025-08-14T09:08:01.853Z"}, "descriptions": [{"lang": "en", "value": "Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key -\u00a0if available in the backup - is encrypted, while the backup file itself remains unencrypted."}], "affected": [{"vendor": "Bosch Rexroth AG", "product": "ctrlX OS - Setup", "versions": [{"version": "1.20.0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "1.20.1"}, {"version": "2.6.0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "2.6.1"}, {"version": "3.6.0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "3.6.2"}]}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "CWE-1104 Use of Unmaintained Third Party Components", "cweId": "CWE-1104"}, {"lang": "en-US", "description": "CWE-311 Missing Encryption of Sensitive Data", "cweId": "CWE-311"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-14T15:46:31.569740Z", "id": "CVE-2025-48862", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T15:46:38.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-48862", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-14T15:46:31.569740Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T15:46:34.434Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Bosch Rexroth AG", "product": "ctrlX OS - Setup", "versions": [{"status": "affected", "version": "1.20.0", "versionType": "custom", "lessThanOrEqual": "1.20.1"}, {"status": "affected", "version": "2.6.0", "versionType": "custom", "lessThanOrEqual": "2.6.1"}, {"status": "affected", "version": "3.6.0", "versionType": "custom", "lessThanOrEqual": "3.6.2"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key -\u00a0if available in the backup - is encrypted, while the backup file itself remains unencrypted."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "cweId": "CWE-1104", "description": "CWE-1104 Use of Unmaintained Third Party Components"}, {"lang": "en-US", "cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2025-08-14T09:08:01.853Z"}}}, "cveMetadata": {"cveId": "CVE-2025-48862", "state": "PUBLISHED", "dateUpdated": "2025-08-14T15:46:38.467Z", "dateReserved": "2025-05-27T10:45:32.638Z", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "datePublished": "2025-08-14T09:08:01.853Z", "assignerShortName": "bosch"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "ctrlX OS - Setup", "vendor": "Bosch Rexroth AG", "versions": [{"lessThanOrEqual": "1.20.1", "status": "affected", "version": "1.20.0", "versionType": "custom"}, {"lessThanOrEqual": "2.6.1", "status": "affected", "version": "2.6.0", "versionType": "custom"}, {"lessThanOrEqual": "3.6.2", "status": "affected", "version": "3.6.0", "versionType": "custom"}]}], "source": "psirt@bosch.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key -\u00a0if available in the backup - is encrypted, while the backup file itself remains unencrypted."}, {"lang": "es", "value": "La redacci\u00f3n ambigua en la interfaz web del mecanismo de configuraci\u00f3n de CtrlX OS podr\u00eda inducir al usuario a creer que el archivo de copia de seguridad est\u00e1 cifrado al establecer una contrase\u00f1a. Sin embargo, solo se cifra la clave privada (si est\u00e1 disponible en la copia de seguridad), mientras que el archivo de copia de seguridad permanece sin cifrar."}], "id": "CVE-2025-48862", "lastModified": "2026-06-17T09:30:24.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "psirt@bosch.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48862", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-14T15:46:31.569740Z", "version": "2.0.3"}}]}, "published": "2025-08-14T09:15:26.293", "references": [{"source": "psirt@bosch.com", "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html"}], "sourceIdentifier": "psirt@bosch.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}, {"lang": "en", "value": "CWE-1104"}], "source": "psirt@bosch.com", "type": "Secondary"}]}

{}

{"created": "2025-08-16T21:41:25.087398+00:00", "updated": "2025-08-16T21:41:25.087452+00:00", "vendors": ["bosch", "bosch$PRODUCT$ctrlx_os"]}